StackRadar

CVE-2025-58181

Medium

Advisory

Published 19 Nov 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,054
of 17,790 indexed, latest versions
Container images
2,352
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

Carried by container images the latest versions of 2,054 of 17,790 indexed charts deploy, on 2,352 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+146 more0.45.02,352
OSV records
GHSA-j5w8-q4qc-rx2x
Also known as
GO-2025-4134

Charts affected

2,054 by stars
ChartLatestAffected imagesRadar Score
rawfile-csiymatrixVerified publisher0.2.12 of 4See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
matrixdb/custom-external-provisioner:4622a07d7-202204247e9ffe249a51
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.45.0
matrixdb/rawfile-csi:v0.2.195b2e38e913d
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.45.0

Open the chart page →

7,998
version-checkerymrs0.2.31 of 1See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
quay.io/jetstack/version-checker:v0.2.15f6f8ba0b671
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.45.0

Open the chart page →

3,024
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.45.0
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.45.0

Open the chart page →

5,047
zahori-moonzahoriVerified publisher1.0.11 of 3See more

zahori-moon zahori 1.0.1

1 of the 3 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
quay.io/aerokube/moon-ui:2.0.589990b146824
golang.org/x/crypto@v0.10.0
0.45.0

Open the chart page →

2,907

Container images carrying it

2,352 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
devopsfaith/krakend:2.7.09219cda867e2
golang.org/x/crypto@v0.24.0
0.45.0
1
devopstales/trivy-operator:2.575136aa7a26e
golang.org/x/crypto@v0.3.0
0.45.0
1
devspacecloud/manager:0.3.349c397413f7b
golang.org/x/crypto@v0.0.0-20200128174031-69ecbb4d6d5d
0.45.0
1
dexidp/dex:v2.39.1-distroless43655afd1a8f
golang.org/x/crypto@v0.18.0
0.45.0
1
deyaeddin/cert-manager-webhook-hetzner:latest797b0d06210a
golang.org/x/crypto@v0.0.0-20210513164829-c07d793c2f9a
0.45.0
1
dgraph/dgraph:v24.1.4b57fa31f9b7f
golang.org/x/crypto@v0.33.0
0.45.0
1
dirathea/pipelinewise-operator:v0.5.08d4c9f773ae1
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.45.0
1
djkormo/adcs-issuer:2.1.29f34e87e7586
golang.org/x/crypto@v0.24.0
0.45.0
1
dollarshaveclub/furan2:master14a257836529
golang.org/x/crypto@v0.0.0-20200820211705-5c72a883971a
0.45.0
1
dollarshaveclub/thermite:0.0.31663cbf25fcfe
golang.org/x/crypto@v0.0.0-20210711020723-a769d52b0f97
0.45.0
1
dongjiang1989/cosign-webhook:v1.1.02a3ead6a55dc
golang.org/x/crypto@v0.10.0
0.45.0
1
dongjiang1989/pingmesh-agent:latest355fa4be8e97
golang.org/x/crypto@v0.28.0
0.45.0
1
dongjiang1989/pingmesh-agent:v1.2.2c82de0272da0
golang.org/x/crypto@v0.28.0
0.45.0
1
doorcloud/apim-operator:v3.0.44e6ef8d72c3e
golang.org/x/crypto@v0.26.0
0.45.0
1
dragonflyoss/client:v0.1.82edf3e921f4e0
golang.org/x/crypto@v0.17.0
0.45.0
1
dragonflyoss/manager:v2.1.49c3ef7f10698d
golang.org/x/crypto@v0.17.0
0.45.0
1
dragonflyoss/scheduler:v2.1.49523785c77787
golang.org/x/crypto@v0.24.0
0.45.0
1
drone/drone:2.28.255897c8fb22d
golang.org/x/crypto@v0.40.0
0.45.0
1
drone/drone-runner-docker:1.8.1137e79c5e23c
golang.org/x/crypto@v0.0.0-20190621222207-cc06ce4a13d4
0.45.0
1
drone/kubernetes-secrets:latest206df2280ecf
golang.org/x/crypto@v0.0.0-20180808211826-de0752318171
0.45.0
1
drorivry4/rego:lateste035d49b15ca
golang.org/x/crypto@v0.17.0
0.45.0
1
drumsergio/duplicacy-container:0.1.0dd3ee9703969
golang.org/x/crypto@v0.12.0
0.45.0
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
golang.org/x/crypto@v0.5.0
0.45.0
1
duplicati/duplicati:2.0.5.111_canary_2020-09-268660f0eda7c9
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.45.0
1
durellirsd/security-smells-api:v17398aca4fc2e
golang.org/x/crypto@v0.21.0
0.45.0
1
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
golang.org/x/crypto@v0.14.0
0.45.0
1
ebrianne/cert-manager-webhook-duckdns:v1.2.39cd17700c9ec
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.45.0
1
eclipseaerios/federator:1.1.018c7f0d101c0
golang.org/x/crypto@v0.23.0
0.45.0
1
eclipseaerios/iota-tangle-peerer:latest99d7ff18d416
golang.org/x/crypto@v0.28.0
0.45.0
1
eclipseaerios/llo-api:1.2.0ab7a04182191
golang.org/x/crypto@v0.14.0
0.45.0
1
eclipseaerios/llo-docker-operator:1.1.2d7ec28bfe735
golang.org/x/crypto@v0.31.0
0.45.0
1
elastic/apm-server:7.17.6c7a1c63257d0
golang.org/x/crypto@v0.0.0-20220817201139-bc19a97f63c8
0.45.0
1
emqx/ecp-emqx-agent-downloader:2.5.1a8431baa7950
golang.org/x/crypto@v0.21.0
0.45.0
1
emqx/ecp-main:2.5.1fa876f71e5d6
golang.org/x/crypto@v0.28.0
0.45.0
1
emqxecp/otelcol:2.5.04c31d9bec846
golang.org/x/crypto@v0.26.0
0.45.0
1
emqx/edge-operator-controller:0.0.553865c1267d9
golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd
0.45.0
1
engrmth/bnkr:2.1.06d8464e6f0e8
golang.org/x/crypto@v0.0.0-20190530122614-20be4c3c3ed5
0.45.0
1
envoyproxy/ai-gateway-controller:003ab39f36923b5d40609a601e2951b73f6318fbec1f06ee29a7
golang.org/x/crypto@v0.40.0
0.45.0
1
envoyproxy/ratelimit:v1.4.071081616da3e
golang.org/x/crypto@v0.0.0-20191219195013-becbf705a915
0.45.0
1
epamedp/admin-console-operator:2.14.090f9921d8d58
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.45.0
1
epamedp/codebase-operator:2.12.0-MDTU-DDM-SNAPSHOT.1096028c86f0dd
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.45.0
1
epamedp/edp-admin-console:2.14.0616c678ba3e7
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.45.0
1
epamedp/edp-argocd-operator:0.2.0976a662a5e72
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.45.0
1
epamedp/edp-headlamp:0.25.093417e18bb1a
golang.org/x/crypto@v0.18.0
0.45.0
1
epamedp/gerrit-operator:2.11.0-MDTU-DDM-SNAPSHOT.2b71fb39e0c9e
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.45.0
1
epamedp/jenkins-operator:2.15.328ef56bc0ca3
golang.org/x/crypto@v0.14.0
0.45.0
1
epamedp/jenkins-operator:2.11.0-MDTU-DDM-SNAPSHOT.1ff25e9fe4419
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.45.0
1
epamedp/keycloak-operator:1.11.0-MDTU-DDM-SNAPSHOT.105d352199e12e
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.45.0
1
epamedp/nexus-operator:2.11.0-MDTU-DDM-SNAPSHOT.1449a53804699
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.45.0
1
epamedp/reconciler:2.12.0d33e938b6d59
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.45.0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.