CVE-2025-6021

High

Advisory

Published 12 Jun 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.014; 70th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 560; of 17,787 indexed, latest versions
Container images: 552; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 560 of 17,787 indexed charts deploy, on 552 images.

Affected package	Affected versions	Fixed in	Images
libxml2deb	2.9.1+dfsg1-3ubuntu4.3, 2.9.1+dfsg1-3ubuntu4.4, 2.9.1+dfsg1-3ubuntu4.12, 2.9.3+dfsg1-1ubuntu0.2+35 more	2.9.1+dfsg1-3ubuntu4.13+esm8, 2.9.3+dfsg1-1ubuntu0.7+esm9, 2.9.4+dfsg1-6.1ubuntu1.9+esm4, 2.9.10+dfsg-5ubuntu0.20.04.10+esm1+3 more	486
libxml2apk	2.13.4-r3, 2.13.4-r5, 2.13.4-r6, 2.13.8-r0	2.13.9-r0	66

OSV records: ALPINE-CVE-2025-6021 DEBIAN-CVE-2025-6021 UBUNTU-CVE-2025-6021
Also known as: USN-7694-1

Charts affected

560 by stars

Chart

Latest

Affected images

Radar Score

myweatherhelm-schedulingwebapp1

1.3.92

1 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

9,225

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	libxml2@2.9.14+dfsg-1.2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

8,858

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

14,420

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

28,699

giteawenerme

12.7.0

2 of 4 See more

gitea wenerme 12.7.0

2 of the 4 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

8,842

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

15,287

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql :17.6.0-debian-12-r4	926356130b77	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,643

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8

Open the chart page →

14,172

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

11,592

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2025-6021.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,685

Container images carrying it

552 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ryuunosukeds3/nadeko-bot-docker :latest	c0398f13e8a9	libxml2@2.9.13+dfsg-1ubuntu0.6	2.9.13+dfsg-1ubuntu0.8	1
saidsef/scapy-containerised :v2025.02	f17f7c435891	libxml2@2.13.4-r3	2.13.9-r0	1
sashafefler/spacecapybara_app :latest	f96d7804c0ca	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
sbs20/scanservjs :release-v3.0.3	dad1fd6e9a98	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
scholtz2/algorand-participation-aramidmain-extended :4.4.1-stable	f12ce1cfb72e	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8	1
scholtz2/algorand-participation-mainnet-extended :4.4.1-stable	5aaa5d4ab8b8	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8	1
scholtz2/algorand-participation-voimain-extended :4.4.1-stable	64966de56d9f	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8	1
scrapinghub/splash :3.4.1	a5f89bc84606	libxml2@2.9.4+dfsg1-6.1ubuntu1.2	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
seafileltd/seafile-mc :9.0.10	6693911bcc40	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
seafileltd/seafile-mc :10.0.1	70628f29c663	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
seafileltd/seafile-mc :9.0.9	7ac833196f60	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8	1
seafileltd/seafile-mc :8.0.7	ed0fcda5e6a9	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
seyiogunniran/my-nginx :1.0	3a0ed39e5830	libxml2@2.13.8-r0	2.13.9-r0	1
shamimkuet/nginx :1.0.2	b82902a76a04	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
sismics/docs :v1.10	f4b0ef019cf1	libxml2@2.9.4+dfsg1-6.1ubuntu1.2	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
sissbruecker/linkding :1.41.0-plus	a222fb777e1f	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
snipe/snipe-it :v6.0.14	55fb7636a98c	libxml2@2.9.10+dfsg-5ubuntu0.20.04.4	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
socialmediamacroscope/autophrase :0.1.5	70fb11d4f531	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
socialmediamacroscope/collect_reddit_comment :0.1.2	19d3d26d53ee	libxml2@2.9.4+dfsg1-6.1ubuntu1.9	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
socialmediamacroscope/histogram :0.1.2	6418f9bdb4d2	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
socialmediamacroscope/image_crawler :0.1.2	f508216be63c	libxml2@2.9.4+dfsg1-6.1ubuntu1.9	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
socialmediamacroscope/network_analysis :0.1.3	b351c21422e6	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	libxml2@2.9.10+dfsg-5ubuntu0.20.04.3	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
somnathmore/custom-nginx :v2	bdfc06cad4ec	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
speckle/speckle-preview-service :2.20.2-branch.testing4.134160-9fad4b2	1f897ca906ea	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
speckle/speckle-preview-service :2.21.3-branch.testing5.219631-2153bef	52cad5e3293e	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
speckle/speckle-preview-service :2.23.14-branch.testing6.334655-b4e04ee	6dee853ba74a	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
speckle/speckle-preview-service :2.25.10-branch.testing6.645-b125c1e	787adcb20a3a	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3	1
speckle/speckle-preview-service :2.20.6-branch.testing1.154030-9b09114	8f3c1ea153ba	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
speckle/speckle-preview-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	c102b087481a	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
speckle/speckle-preview-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	d3da0a84de98	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
stackstorm/st2actionrunner :3.8	88235ba70cad	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2api :3.8	6f56d239d280	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2auth :3.8	33ecfda16608	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2notifier :3.8	f190a6212195	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2rulesengine :3.8	259503496ff9	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2scheduler :3.8	b1de2055c362	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2stream :3.8	1c8904a3bf67	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stashapp/stash :latest	24dbd7607174	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
stashapp/stash-box :latest	a534c8afdf39	libxml2@2.9.14+dfsg-1.3ubuntu3.3	2.9.14+dfsg-1.3ubuntu3.4	1
statcan/ckan :2.9	3921305425b8	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
substratusai/verba :v0.4.0-baseURL2	61695be635eb	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
svcosti/cidrapp :latest	8428d87bc5d0	libxml2@2.13.4-r5	2.13.9-r0	1