CVE-2025-58183

High

Advisory

Published 29 Oct 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,505; of 17,828 indexed, latest versions
Container images: 3,957; deployed by those charts
Fix available: 8 of 9; affected packages

Red Hat Security Advisory: skopeo security update

Carried by container images the latest versions of 3,505 of 17,828 indexed charts deploy, on 3,957 images.

Affected package	Affected versions	Fixed in	Images
skopeorpm	2:1.11.2-0.1.el9, 2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c	2:1.14.5-5.module+el8.10.0+23772+e5018371, 2:1.20.0-2.el9_7	2
containers-commonrpm	2:1-64.module+el8.8.0+18571+eed59fc4	2:1-82.module+el8.10.0+23772+e5018371	1
criurpm	3.15-4.module+el8.8.0+19044+f9982fd8	0:3.18-5.module+el8.10.0+23772+e5018371	1
fuse-overlayfsrpm	1.11-1.module+el8.8.0+18634+9a268292	0:1.13-1.module+el8.10.0+23772+e5018371	1
libslirprpm	4.4.0-1.module+el8.8.0+18060+3f21f2cc	0:4.4.0-2.module+el8.10.0+23772+e5018371	1
runcrpm	1:1.1.4-1.module+el8.8.0+18060+3f21f2cc	4:1.2.9-2.module+el8.10.0+23772+e5018371	1
slirp4netnsrpm	1.2.0-2.module+el8.8.0+18060+3f21f2cc	0:1.2.3-1.module+el8.10.0+23772+e5018371	1
golang-1.19deb	1.19.8-2	no fix listed	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+165 more	1.24.8	3,957

OSV records: RHSA-2025:23326 RHSA-2025:23374 DEBIAN-CVE-2025-58183 GO-2025-4014
Also known as: BIT-golang-2025-58183, RHSA-2026:5234

Charts affected

3,505 by stars

Chart

Latest

Affected images

Radar Score

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2025-58183.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.24.8
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.24.8
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.24.8

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-58183.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.24.8

Open the chart page →

2,482

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-58183.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.24.8

Open the chart page →

3,702

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-58183.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.24.8

Open the chart page →

1,249

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-58183.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	stdlib@go1.24.6	1.24.8

Open the chart page →

8,105

Container images carrying it

3,957 by charts deploying them

A fixed version is listed for 8 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.k8s.io/sig-storage/nfsplugin :v4.11.0	ce5b5ccd5eb0	stdlib@go1.23.6	1.24.8	1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.0	3ce0fdba4d8e	stdlib@go1.15	1.24.8	1
registry.k8s.io/sig-storage/snapshot-controller :v8.2.1	472fa35a89da	stdlib@go1.23.6	1.24.8	1
registry.k8s.io/sig-storage/snapshot-controller :v4.2.1	95587f8777d7	stdlib@go1.16.2	1.24.8	1
registry.k8s.io/sig-storage/snapshot-controller :v6.2.1	98bab4eaf23c	stdlib@go1.19	1.24.8	1
registry.k8s.io/sig-storage/snapshot-controller :v6.3.1	ce6ca3c0e30b	stdlib@go1.20.5	1.24.8	1
registry.k8s.io/sig-storage/volume-data-source-validator :v1.0.0	d35884236461	stdlib@go1.17.3	1.24.8	1