CVE-2025-6021

High

Advisory

Published 12 Jun 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.014; 70th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 560; of 17,787 indexed, latest versions
Container images: 552; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 560 of 17,787 indexed charts deploy, on 552 images.

Affected package	Affected versions	Fixed in	Images
libxml2deb	2.9.1+dfsg1-3ubuntu4.3, 2.9.1+dfsg1-3ubuntu4.4, 2.9.1+dfsg1-3ubuntu4.12, 2.9.3+dfsg1-1ubuntu0.2+35 more	2.9.1+dfsg1-3ubuntu4.13+esm8, 2.9.3+dfsg1-1ubuntu0.7+esm9, 2.9.4+dfsg1-6.1ubuntu1.9+esm4, 2.9.10+dfsg-5ubuntu0.20.04.10+esm1+3 more	486
libxml2apk	2.13.4-r3, 2.13.4-r5, 2.13.4-r6, 2.13.8-r0	2.13.9-r0	66

OSV records: ALPINE-CVE-2025-6021 DEBIAN-CVE-2025-6021 UBUNTU-CVE-2025-6021
Also known as: USN-7694-1

Charts affected

560 by stars

Chart

Latest

Affected images

Radar Score

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

9,130

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	libxml2@2.9.14+dfsg-1.2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

10,001

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

28,605

giteawenerme

12.7.0

2 of 4 See more

gitea wenerme 12.7.0

2 of the 4 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

8,811

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

15,230

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql :17.6.0-debian-12-r4	926356130b77	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,624

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8

Open the chart page →

14,100

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

11,577

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,673

Container images carrying it

552 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.k8s.io/ingress-nginx/controller :v1.13.1	37e489b22ac7	libxml2@2.13.8-r0	2.13.9-r0	1
registry.k8s.io/ingress-nginx/controller :v1.12.0	e6b8de175acd	libxml2@2.13.4-r3	2.13.9-r0	1