CVE-2025-5994

High

Advisory

Published 16 Jul 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.002; 10th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 26; of 17,781 indexed, latest versions
Container images: 38; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: unbound security update

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 38 images.

Affected package	Affected versions	Fixed in	Images
unbounddeb	1.9.4-2ubuntu1.1, 1.9.4-2ubuntu1.2, 1.13.1-1ubuntu5.8, 1.17.1-2+2 more	1.13.1-1ubuntu5.11, 1.17.1-2+deb12u3, 1.19.2-1ubuntu3.5	14
unboundapk	1.19.3-r0	1.20.0-r2	1
unboundrpm	1.7.3-14.el8, 1.7.3-15.el8, 1.7.3-17.el8, 1.16.2-3.el9_3.5+4 more	0:1.16.2-5.9.el8_10, 0:1.16.2-19.el9_6.1	23

OSV records: ALPINE-CVE-2025-5994 DEBIAN-CVE-2025-5994 RHSA-2025:11849 RHSA-2025:11884 UBUNTU-CVE-2025-5994
Also known as: RHSA-2025:12416, RHSA-2025:12929, RHSA-2025:13575, RHSA-2025:13577, USN-7666-1

Charts affected

26 by stars

Chart

Latest

Affected images

Radar Score

codetogethercodetogether

1.4.25

1 of 1 See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
codetogether/codetogether :latest	4348c8a38752	unbound@1.16.2-3.el9_3.5	0:1.16.2-19.el9_6.1

Open the chart page →

7,450

oesopsmx

4.0.32

1 of 25 See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
quay.io/opsmxpublic/ubi8-oes-db :v3.0.0	89ee6493af89	unbound@1.7.3-15.el8	0:1.16.2-5.9.el8_10

Open the chart page →

107,811

anteonanteon

2.6.4

1 of 13 See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
ddosify/selfhosted_backend :3.2.9	3c11e3182652	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3

Open the chart page →

22,202

gentrace-self-hostedgentrace-self-hosted

0.1.3

1 of 9 See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10

Open the chart page →

15,562

napcatredish101

0.1.3

1 of 1 See more

napcat redish101 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
mlikiowa/napcat-docker :latest	1336a777f9a4	unbound@1.13.1-1ubuntu5.8	1.13.1-1ubuntu5.11

Open the chart page →

7,405

sentry-k8ssentry-k8s

1.4.1

1 of 11 See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.6.6	83dbca3efd2a	unbound@1.16.2-5.8.el8_10	0:1.16.2-5.9.el8_10

Open the chart page →

16,449

varnish-cachevarnish

1.1.1

1 of 1 See more

varnish-cache varnish 1.1.1

1 of the 1 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
library/varnish :7.5.0	4d0bb287d87b	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3

Open the chart page →

4,249

open5gsadaptivenetlab

1.0.3

1 of 3 See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	unbound@1.9.4-2ubuntu1.1	no fix listed

Open the chart page →

25,443

aktoakto

0.2.0

2 of 7 See more

akto akto 0.2.0

2 of the 7 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :6.2.11-1-ubi8	ac776fad95a5	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-zookeeper :6.2.11-1-ubi8	cae577096489	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10

Open the chart page →

13,613

akto-mini-testing-kafkaakto

1.42.1

2 of 5 See more

akto-mini-testing-kafka akto 1.42.1

2 of the 5 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.8.0-3-ubi8	adc392d28a1e	unbound@1.16.2-5.el8_9.6	0:1.16.2-5.9.el8_10
confluentinc/cp-zookeeper :7.8.0-3-ubi8	5ca5f3269814	unbound@1.16.2-5.el8_9.6	0:1.16.2-5.9.el8_10

Open the chart page →

6,397

akto-protectionakto

0.1.0

2 of 4 See more

akto-protection akto 0.1.0

2 of the 4 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :6.2.11-1-ubi8	ac776fad95a5	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-zookeeper :6.2.11-1-ubi8	cae577096489	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10

Open the chart page →

11,285

ddosifyanteon

1.7.5

2 of 13 See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
ddosify/selfhosted_alaz_backend :1.0.6	a43c5155fa1c	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3
ddosify/selfhosted_backend :2.6.11	ac323d52bfb4	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3

Open the chart page →

25,669

app-mobilityappmo

0.1.0

1 of 5 See more

app-mobility appmo 0.1.0

1 of the 5 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
dellemc/csm-application-mobility-controller :v0.1.0	148ada9060a9	unbound@1.7.3-17.el8	0:1.16.2-5.9.el8_10

Open the chart page →

12,521

automatedconfigurationassist-iot-automated-configuration

1.0.0

2 of 5 See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.5.1	dc9b972db002	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-zookeeper :7.5.1	0bec03c1f3ce	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10

Open the chart page →

14,728

dnsbl-exporterchristianhuth

1.4.0

1 of 2 See more

dnsbl-exporter christianhuth 1.4.0

1 of the 2 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
ghcr.io/luzilla/unbound :v0.7.0-rc3	252613692e5e	unbound@1.19.3-r0	1.20.0-r2

Open the chart page →

1,459

sumoconsensys

0.4.145

1 of 4 See more

sumo consensys 0.4.145

1 of the 4 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.1.2.amd64	3bf359d5e340	unbound@1.7.3-17.el8	0:1.16.2-5.9.el8_10

Open the chart page →

5,958

cp-helm-chartscp-helm-charts

0.6.1

7 of 8 See more

cp-helm-charts cp-helm-charts 0.6.1

7 of the 8 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-enterprise-control-center :6.1.0	f2975d507a2a	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-enterprise-kafka :6.1.0	8f1544df1f48	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-kafka-connect :6.1.0	4bc70a83ca6f	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-kafka-rest :6.1.0	b0b7aa26254a	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-ksqldb-server :6.1.0	ee403d5b9090	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-schema-registry :6.1.0	b651d4b6185a	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10
confluentinc/cp-zookeeper :6.1.0	78c190f4472c	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10

Open the chart page →

58,857

domainmoddjjudas21

1.0.0

1 of 1 See more

domainmod djjudas21 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
domainmod/domainmod :4.23.0	4017bfe4c597	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3

Open the chart page →

7,141

ibexaibexa

3.11.1

1 of 10 See more

ibexa ibexa 3.11.1

1 of the 10 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
boky/postfix :4.4.0	f3f247fd4252	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3

Open the chart page →

5,959

kube-ovnkube-ovn-test

1.14.0

1 of 1 See more

kube-ovn kube-ovn-test 1.14.0

1 of the 1 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
kubeovn/kube-ovn :v1.14.0	6722b54eb5c0	unbound@1.19.2-1ubuntu3.4	1.19.2-1ubuntu3.5

Open the chart page →

4,940

MINTmint

8.0.2

1 of 15 See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
mintproject/graphql-engine :305c0dbeba1878eafe348f21fc300fbfc017d9dc	83aade2c1855	unbound@1.9.4-2ubuntu1.2	no fix listed

Open the chart page →

43,341

cockroachdb-operatormmontes

0.1.0

1 of 1 See more

cockroachdb-operator mmontes 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
cockroachdb/cockroach-operator :v2.1.0	983312754620	unbound@1.7.3-15.el8	0:1.16.2-5.9.el8_10

Open the chart page →

7,775

smilencsa

1.1.0

4 of 23 See more

smile ncsa 1.1.0

4 of the 23 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
socialmediamacroscope/histogram :0.1.2	6418f9bdb4d2	unbound@1.17.1-2	1.17.1-2+deb12u3
socialmediamacroscope/network_analysis :0.1.3	b351c21422e6	unbound@1.17.1-2	1.17.1-2+deb12u3
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	unbound@1.17.1-2	1.17.1-2+deb12u3
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	unbound@1.17.1-2	1.17.1-2+deb12u3

Open the chart page →

109,294

kubecostradar-base

1.0.0

1 of 7 See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
gcr.io/kubecost1/kubecost-modeling :v0.1.22	a461dc5cb96a	unbound@1.16.2-8.el9_5.1	0:1.16.2-19.el9_6.1

Open the chart page →

9,355

radar-cp-ksql-serverradar-base

0.0.2

1 of 2 See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
confluentinc/cp-ksqldb-server :7.6.0	8ec46c27982f	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10

Open the chart page →

5,269

allurestakater

1.0.1

1 of 1 See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-5994.

Container image	Digest	Package	Fixed in
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	unbound@1.7.3-15.el8	0:1.16.2-5.9.el8_10

Open the chart page →

28,165

Container images carrying it

38 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
confluentinc/cp-kafka :6.2.11-1-ubi8	ac776fad95a5	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10	2
confluentinc/cp-zookeeper :6.2.11-1-ubi8	cae577096489	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10	2
boky/postfix :4.4.0	f3f247fd4252	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3	1
cockroachdb/cockroach-operator :v2.1.0	983312754620	unbound@1.7.3-15.el8	0:1.16.2-5.9.el8_10	1
codetogether/codetogether :latest	4348c8a38752	unbound@1.16.2-3.el9_3.5	0:1.16.2-19.el9_6.1	1
confluentinc/cp-enterprise-control-center :6.1.0	f2975d507a2a	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-enterprise-kafka :6.1.0	8f1544df1f48	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-kafka :7.1.2.amd64	3bf359d5e340	unbound@1.7.3-17.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-kafka :7.6.6	83dbca3efd2a	unbound@1.16.2-5.8.el8_10	0:1.16.2-5.9.el8_10	1
confluentinc/cp-kafka :7.8.0-3-ubi8	adc392d28a1e	unbound@1.16.2-5.el8_9.6	0:1.16.2-5.9.el8_10	1
confluentinc/cp-kafka :7.4.4	c0224a1adf7a	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-kafka :7.5.1	dc9b972db002	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-kafka-connect :6.1.0	4bc70a83ca6f	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-kafka-rest :6.1.0	b0b7aa26254a	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-ksqldb-server :7.6.0	8ec46c27982f	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-ksqldb-server :6.1.0	ee403d5b9090	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-schema-registry :6.1.0	b651d4b6185a	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-zookeeper :7.5.1	0bec03c1f3ce	unbound@1.16.2-5.el8	0:1.16.2-5.9.el8_10	1
confluentinc/cp-zookeeper :7.8.0-3-ubi8	5ca5f3269814	unbound@1.16.2-5.el8_9.6	0:1.16.2-5.9.el8_10	1
confluentinc/cp-zookeeper :6.1.0	78c190f4472c	unbound@1.7.3-14.el8	0:1.16.2-5.9.el8_10	1
ddosify/selfhosted_alaz_backend :1.0.6	a43c5155fa1c	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3	1
ddosify/selfhosted_backend :3.2.9	3c11e3182652	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3	1
ddosify/selfhosted_backend :2.6.11	ac323d52bfb4	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3	1
dellemc/csm-application-mobility-controller :v0.1.0	148ada9060a9	unbound@1.7.3-17.el8	0:1.16.2-5.9.el8_10	1
domainmod/domainmod :4.23.0	4017bfe4c597	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3	1
kubeovn/kube-ovn :v1.14.0	6722b54eb5c0	unbound@1.19.2-1ubuntu3.4	1.19.2-1ubuntu3.5	1
library/varnish :7.5.0	4d0bb287d87b	unbound@1.17.1-2+deb12u2	1.17.1-2+deb12u3	1
mintproject/graphql-engine :305c0dbeba1878eafe348f21fc300fbfc017d9dc	83aade2c1855	unbound@1.9.4-2ubuntu1.2	no fix listed	1
mlikiowa/napcat-docker :latest	1336a777f9a4	unbound@1.13.1-1ubuntu5.8	1.13.1-1ubuntu5.11	1
socialmediamacroscope/histogram :0.1.2	6418f9bdb4d2	unbound@1.17.1-2	1.17.1-2+deb12u3	1
socialmediamacroscope/network_analysis :0.1.3	b351c21422e6	unbound@1.17.1-2	1.17.1-2+deb12u3	1
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	unbound@1.17.1-2	1.17.1-2+deb12u3	1
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	unbound@1.17.1-2	1.17.1-2+deb12u3	1
gcr.io/kubecost1/kubecost-modeling :v0.1.22	a461dc5cb96a	unbound@1.16.2-8.el9_5.1	0:1.16.2-19.el9_6.1	1
ghcr.io/luzilla/unbound :v0.7.0-rc3	252613692e5e	unbound@1.19.3-r0	1.20.0-r2	1
quay.io/eformat/jenkins-agent-graalvm :latest	a3b9a07648b6	unbound@1.7.3-15.el8	0:1.16.2-5.9.el8_10	1
quay.io/opsmxpublic/ubi8-oes-db :v3.0.0	89ee6493af89	unbound@1.7.3-15.el8	0:1.16.2-5.9.el8_10	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	unbound@1.9.4-2ubuntu1.1	no fix listed	1