CVE-2025-6141

Medium

Advisory

Published 16 Jun 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.8; base score, highest
EPSS: 0.002; 8th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,354; of 17,790 indexed, latest versions
Container images: 2,327; deployed by those charts
Fix available: 2 of 2; affected packages

CVE-2025-6141 affecting package ncurses for versions less than 6.4-3

Carried by container images the latest versions of 2,354 of 17,790 indexed charts deploy, on 2,327 images.

Affected package	Affected versions	Fixed in	Images
ncursesdeb	5.9+20140118-1ubuntu1, 6.0+20160213-1ubuntu1, 6.1-1ubuntu1, 6.1-1ubuntu1.18.04+12 more	5.9+20140118-1ubuntu1+esm7, 6.0+20160213-1ubuntu1+esm7, 6.1-1ubuntu1.18.04.1+esm4, 6.2-0ubuntu2.1+esm2+2 more	2,326
ncursesrpm	6.4-2.azl3	6.4-3	1

OSV records: DEBIAN-CVE-2025-6141 UBUNTU-CVE-2025-6141 AZL-64139
Also known as: USN-8709-1

Charts affected

2,354 by stars

Chart

Latest

Affected images

Radar Score

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-6141.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	ncurses@6.4-4	no fix listed

Open the chart page →

2,684

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2025-6141.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	ncurses@6.5+20250216-2	no fix listed

Open the chart page →

1,849

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-6141.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	ncurses@6.1-1ubuntu1.18.04	6.1-1ubuntu1.18.04.1+esm4
yandex/clickhouse-server :21.3.20	4eccfffb01d7	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2

Open the chart page →

9,256

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-6141.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	ncurses@6.3-2ubuntu0.2	6.3-2ubuntu0.3

Open the chart page →

7,929

Container images carrying it

2,327 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/smarter-project/hydra/crismux :main	673d5229df1f	ncurses@6.4-4	no fix listed	3
quay.io/devtron/ai-agent :0.0.1	6545dac92173	ncurses@6.4-4	no fix listed	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	ncurses@6.3-2	6.3-2ubuntu0.3	3
quay.io/devtron/casbin :172ef62b-9450794d-464-39422	5bf041aacadd	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	3
quay.io/devtron/chart-sync :94237c18-1021-39419	60566529446a	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	3
quay.io/devtron/chart-sync :3b3d6d0e-836-39296	721b5c9634d4	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	3
quay.io/devtron/devtron :9450794d-930-39415	9795f3f9f031	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	3
quay.io/devtron/google-chat-alert-manager :v2.0.2	39f2c6e0af38	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2	3
quay.io/devtron/hyperion :0874dcaf-280-39287	01d5d8c4cecb	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	3
quay.io/devtron/inception :7beef376-948-31378	4c3b91bebd3d	ncurses@6.0+20160213-1ubuntu1	6.0+20160213-1ubuntu1+esm7	3
quay.io/devtron/k8s-utils :807ca3c2-488-14005	f296c2ec5db7	ncurses@6.3-2	6.3-2ubuntu0.3	3
quay.io/devtron/kubelink :94237c18-314-39417	9d25865295af	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	3
quay.io/devtron/kubelink :09867a9c-564-39289	ea6dd1e4ce71	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	ncurses@6.4-4	no fix listed	3
actualbudget/actual-server :26.9.0	552beab3dec8	ncurses@6.4-4	no fix listed	2
alazidis/kube-netlag :1.1.0	0e8c84152201	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	2
apache/apisix :3.18.0-ubuntu	9ee5df1611f9	ncurses@6.4+20240113-1ubuntu2.1	6.4+20240113-1ubuntu2.2	2
apache/nifi-registry :1.26.0	7cdfd8deec92	ncurses@6.3-2ubuntu0.1	6.3-2ubuntu0.3	2
apache/rocketmq :5.4.0	319cd8a81ed1	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	2
apache/tika :2.9.2.1-full	ae0b86d3c4d0	ncurses@6.4+20240113-1ubuntu2	6.4+20240113-1ubuntu2.2	2
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	ncurses@6.4-4	no fix listed	2
bitnamilegacy/etcd :latest	99b408c15272	ncurses@6.4-4	no fix listed	2
bitnamilegacy/mariadb :11.4.5-debian-12-r9	33ce23601fc9	ncurses@6.4-4	no fix listed	2
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	ncurses@6.4-4	no fix listed	2
bitnamilegacy/postgresql :16.4.0-debian-12-r14	94bc968141e7	ncurses@6.4-4	no fix listed	2
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	ncurses@6.4-4	no fix listed	2
bitnamilegacy/redis :latest	5927ff3702df	ncurses@6.4-4	no fix listed	2
bitnamilegacy/valkey-cluster :8.1.3-debian-12-r3	32869e769b7e	ncurses@6.4-4	no fix listed	2
bitnami/minideb :latest	ab4d5b45116e	ncurses@6.5+20250216-2	no fix listed	2
blockstack/stacks-core :3.2.0.0.0	f79944317326	ncurses@6.4-4	no fix listed	2
cagriekin/pg-ha :2.0.1-pg18	99e17aa165df	ncurses@6.5+20250216-2	no fix listed	2
cfssl/cfssl :latest :v1.6.5	c9018c2ddf0b	ncurses@6.4-4	no fix listed	2
chromedp/headless-shell :148.0.7778.97	313ed7255ae1	ncurses@6.5+20250216-2	no fix listed	2
clickhouse/clickhouse-server :24.2	ed9640bfff07	ncurses@6.2-0ubuntu2.1	6.2-0ubuntu2.1+esm2	2
cribl/cribl :4.19.2	044f9a5fac9a	ncurses@6.4+20240113-1ubuntu2.1	6.4+20240113-1ubuntu2.2	2
dagster/user-code-example :1.13.22	5947f9ae481c	ncurses@6.5+20250216-2	no fix listed	2
datagrok/grok_connect :latest	f5876d3aebb8	ncurses@6.3-2ubuntu0.2	6.3-2ubuntu0.3	2
emberstack/kubernetes-reflector :10.0.65	51dbd5880929	ncurses@6.4+20240113-1ubuntu2.1	6.4+20240113-1ubuntu2.2	2
eqalpha/keydb :latest	6537505c4235	ncurses@6.2-0ubuntu2.1	6.2-0ubuntu2.1+esm2	2
eqalpha/keydb :x86_64_v6.3.4	eceb1806730c	ncurses@6.2-0ubuntu2.1	6.2-0ubuntu2.1+esm2	2
fireflyiii/core :version-6.5.9	fe4ecec4c2ba	ncurses@6.5+20250216-2	no fix listed	2
fireflyiii/data-importer :version-2.2.3	ab52bf932546	ncurses@6.5+20250216-2	no fix listed	2
freeradius/freeradius-server :3.0.21	21c8bfa904d8	ncurses@6.1-1ubuntu1.18.04	6.1-1ubuntu1.18.04.1+esm4	2
freikin/dawarich :1.14.5	11826c67e4b1	ncurses@6.5+20250216-2	no fix listed	2
geoservercloud/geoserver-cloud-gateway :1.0-RC3	756559ee788a	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2	2
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1+esm2	2