StackRadar

CVE-2025-58181

Medium

Advisory

Published 19 Nov 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,054
of 17,790 indexed, latest versions
Container images
2,352
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

Carried by container images the latest versions of 2,054 of 17,790 indexed charts deploy, on 2,352 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+146 more0.45.02,352
OSV records
GHSA-j5w8-q4qc-rx2x
Also known as
GO-2025-4134

Charts affected

2,054 by stars
ChartLatestAffected imagesRadar Score
rawfile-csiymatrixVerified publisher0.2.12 of 4See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
matrixdb/custom-external-provisioner:4622a07d7-202204247e9ffe249a51
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.45.0
matrixdb/rawfile-csi:v0.2.195b2e38e913d
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.45.0

Open the chart page →

7,998
version-checkerymrs0.2.31 of 1See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
quay.io/jetstack/version-checker:v0.2.15f6f8ba0b671
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.45.0

Open the chart page →

3,024
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.45.0
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.45.0

Open the chart page →

5,047
zahori-moonzahoriVerified publisher1.0.11 of 3See more

zahori-moon zahori 1.0.1

1 of the 3 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
quay.io/aerokube/moon-ui:2.0.589990b146824
golang.org/x/crypto@v0.10.0
0.45.0

Open the chart page →

2,907

Container images carrying it

2,352 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
golang.org/x/crypto@v0.13.0
0.45.0
2
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
golang.org/x/crypto@v0.9.0
0.45.0
2
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
golang.org/x/crypto@v0.5.0
0.45.0
2
quay.io/oauth2-proxy/oauth2-proxy:v7.3.08c21390be87d
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.45.0
2
quay.io/openshift/origin-cli:4.7464a3af4dfe0
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.45.0
2
quay.io/openshift/origin-cli:4.8bb5e052770e5
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.45.0
2
quay.io/prometheus/blackbox-exporter:v0.24.03af31f8bd1ad
golang.org/x/crypto@v0.8.0
0.45.0
2
quay.io/prometheuscommunity/json-exporter:v0.7.03a777171d39a
golang.org/x/crypto@v0.31.0
0.45.0
2
quay.io/prometheus/node-exporter:v1.3.023ff46c728b9
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.45.0
2
quay.io/prometheus/node-exporter:v1.0.08a3a33cad0bd
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.45.0
2
quay.io/prometheus/node-exporter:v1.3.1f2269e73124d
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.45.0
2
quay.io/prometheus-operator/prometheus-config-reloader:v0.67.014feefde1b80
golang.org/x/crypto@v0.11.0
0.45.0
2
quay.io/prometheus-operator/prometheus-config-reloader:v0.79.2193280a33bc1
golang.org/x/crypto@v0.31.0
0.45.0
2
quay.io/prometheus-operator/prometheus-config-reloader:v0.78.2944b2c67345c
golang.org/x/crypto@v0.28.0
0.45.0
2
quay.io/prometheus-operator/prometheus-config-reloader:v0.77.2c96d4fb1d57f
golang.org/x/crypto@v0.27.0
0.45.0
2
quay.io/prometheus-operator/prometheus-operator:v0.44.0983627001c89
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.45.0
2
quay.io/prometheus/prometheus:v2.53.0075b1ba2c4eb
golang.org/x/crypto@v0.24.0
0.45.0
2
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
golang.org/x/crypto@v0.31.0
0.45.0
2
quay.io/prometheus/prometheus:v2.22.1b899dbd1b901
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.45.0
2
quay.io/prometheus/prometheus:v2.47.0c5dd35038287
golang.org/x/crypto@v0.11.0
0.45.0
2
quay.io/prometheus/prometheus:v2.36.2df0cd5887887
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.45.0
2
quay.io/prometheus/prometheus:v2.54.1f6639335d34a
golang.org/x/crypto@v0.25.0
0.45.0
2
quay.io/prometheus/pushgateway:v1.11.249ed9fdf3780
golang.org/x/crypto@v0.43.0
0.45.0
2
quay.io/prometheus/pushgateway:v1.6.2979a69ab4a40
golang.org/x/crypto@v0.8.0
0.45.0
2
quay.io/prometheus/pushgateway:v1.11.099392035ae99
golang.org/x/crypto@v0.32.0
0.45.0
2
quay.io/thanos/thanos:v0.39.21d022ef4b8ef
golang.org/x/crypto@v0.39.0
0.45.0
2
registry.k8s.io/etcd:3.5.6-0dd75ec974b0a
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.45.0
2
registry.k8s.io/kube-apiserver:v1.26.199e1ed9fbc8a
golang.org/x/crypto@v0.1.0
0.45.0
2
registry.k8s.io/kube-controller-manager:v1.26.140adecbe3a40
golang.org/x/crypto@v0.1.0
0.45.0
2
registry.k8s.io/kube-scheduler:v1.30.1474a5cf9cfa9f
golang.org/x/crypto@v0.21.0
0.45.0
2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.5.009a36e2be1db
golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd
0.45.0
2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.7.0a15ca437f230
golang.org/x/crypto@v0.0.0-20221012134737-56aed061732a
0.45.0
2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.1af8220f53493
golang.org/x/crypto@v0.14.0
0.45.0
2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.6.0bdab4e49d71d
golang.org/x/crypto@v0.0.0-20220315160706-3147a52a75dd
0.45.0
2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.15.0db384bf43222
golang.org/x/crypto@v0.31.0
0.45.0
2
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.0ec5d6f6be228
golang.org/x/crypto@v0.9.0
0.45.0
2
registry.k8s.io/metrics-server/metrics-server:v0.8.089258156d0e9
golang.org/x/crypto@v0.38.0
0.45.0
2
registry.k8s.io/sig-storage/csi-provisioner:v3.1.0122bfb8c1eda
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.45.0
2
registry.k8s.io/sig-storage/csi-provisioner:v6.1.1d992c36d4ddd
golang.org/x/crypto@v0.41.0
0.45.0
2
registry.k8s.io/sig-storage/csi-provisioner:v6.1.0e5900dc98b0d
golang.org/x/crypto@v0.41.0
0.45.0
2
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.263d5e04551ec
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.45.0
2
0xpolygon/bor:1.3.7396d3de26d8b
golang.org/x/crypto@v0.24.0
0.45.0
1
0xpolygon/heimdall:1.0.134ddf259993c
golang.org/x/crypto@v0.1.0
0.45.0
1
1dev/server:11.9.0cd5b12fe5471
golang.org/x/crypto@v0.37.0
0.45.0
1
1password/connect-api:1.7.26aa94cf713f9
golang.org/x/crypto@v0.12.0
0.45.0
1
1password/connect-sync:1.7.2fe527ed9d81f
golang.org/x/crypto@v0.12.0
0.45.0
1
abiondevelopment/cert-manager-webhook-abion:latestc741988fbd23
golang.org/x/crypto@v0.42.0
0.45.0
1
abohatyrenko/bucket-backup-restore:latestfa98af15a13e
golang.org/x/crypto@v0.14.0
0.45.0
1
aboogie/login_test_backend:new9c41a4483ac8
golang.org/x/crypto@v0.26.0
0.45.0
1
absaoss/terraform-controller:v0.0.20ad538a1285a0
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.45.0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.