StackRadar

CVE-2025-61728

Medium

Advisory

Published 28 Jan 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.007
53rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
3,835
of 17,926 indexed, latest versions
Container images
4,259
deployed by those charts
Fix available
1 of 2
affected packages

Excessive CPU consumption when building archive index in archive/zip

Carried by container images the latest versions of 3,835 of 17,926 indexed charts deploy, on 4,259 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+174 more1.24.124,259
OSV records
DEBIAN-CVE-2025-61728GO-2026-4342
Also known as
BIT-golang-2025-61728

Charts affected

3,835 by stars
ChartLatestAffected imagesRadar Score
alertmanager-discordgeek-cookbookVerified publisher1.3.21 of 1See more

alertmanager-discord geek-cookbook 1.3.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
rogerrum/alertmanager-discord:1.0.3827593369625
stdlib@go1.17.4
1.24.12

Open the chart page →

1,046
anonaddygeek-cookbookVerified publisher6.0.01 of 1See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
anonaddy/anonaddy:0.12.3957a95565166
stdlib@go1.18.3
1.24.12

Open the chart page →

4,837
apache-musicindexgeek-cookbookVerified publisher2.4.21 of 1See more

apache-musicindex geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/apache-musicindex:v1.4.1-2c9bd82dc5fda
stdlib@go1.18.4
1.24.12

Open the chart page →

15,138
autobrrgeek-cookbookVerified publisher1.1.31 of 1See more

autobrr geek-cookbook 1.1.3

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/autobrr/autobrr:v1.10.0d4022cd32df5
stdlib@go1.19.3
1.24.12

Open the chart page →

2,233
calibre-webgeek-cookbookVerified publisher8.4.21 of 1See more

calibre-web geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
linuxserver/calibre-web:version-0.6.12938810eca3d3
stdlib@go1.16.7
1.24.12

Open the chart page →

16,711
dendritegeek-cookbookVerified publisher6.4.01 of 1See more

dendrite geek-cookbook 6.4.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/matrix-org/dendrite-monolith:v0.9.43267d27d392f
stdlib@go1.18.5
1.24.12

Open the chart page →

2,163
duplicatigeek-cookbookVerified publisher5.4.21 of 1See more

duplicati geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/duplicati:lateste1fdac6133ad
stdlib@go1.24.9
1.24.12

Open the chart page →

1,834
embygeek-cookbookVerified publisher3.4.21 of 1See more

emby geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/emby:v4.6.1.05c6b8f91f1c4
stdlib@go1.15
1.24.12

Open the chart page →

8,751
gatusgeek-cookbookVerified publisher1.1.21 of 1See more

gatus geek-cookbook 1.1.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
twinproduction/gatus:v3.8.049dc0d9b2e2c
stdlib@go1.18.1
1.24.12

Open the chart page →

1,885
gonicgeek-cookbookVerified publisher6.4.21 of 1See more

gonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
sentriz/gonic:v0.13.1a74012a6adf3
stdlib@go1.16.4
1.24.12

Open the chart page →

3,528
gotifygeek-cookbookVerified publisher1.2.21 of 1See more

gotify geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
gotify/server:2.1.409c79bc1e403
stdlib@go1.16
1.24.12

Open the chart page →

3,128
haste-servergeek-cookbookVerified publisher3.4.21 of 1See more

haste-server geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/haste-server:latest827aa2f2389d
stdlib@go1.15
1.24.12

Open the chart page →

11,282
jackettgeek-cookbookVerified publisher11.7.21 of 1See more

jackett geek-cookbook 11.7.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/jackett:v0.20.13163a4715b46aa2
stdlib@go1.18.3
1.24.12

Open the chart page →

10,094
lidarrgeek-cookbookVerified publisher14.2.21 of 1See more

lidarr geek-cookbook 14.2.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/lidarr:v1.0.0.225554ebc1f90963
stdlib@go1.16.7
1.24.12

Open the chart page →

14,758
maddygeek-cookbookVerified publisher3.2.01 of 1See more

maddy geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
foxcpp/maddy:v0.5.28fa2bd8f6830
stdlib@go1.17.2
1.24.12

Open the chart page →

2,627
minifluxgeek-cookbookVerified publisher5.2.01 of 2See more

miniflux geek-cookbook 5.2.0

1 of the 2 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
miniflux/miniflux:2.0.36e2fb990dae74
stdlib@go1.17.8
1.24.12

Open the chart page →

2,425
navidromegeek-cookbookVerified publisher6.4.21 of 1See more

navidrome geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
deluan/navidrome:0.43.04e9ae3bff6aa
stdlib@go1.16.4
1.24.12

Open the chart page →

3,603
nullservgeek-cookbookVerified publisher2.4.21 of 1See more

nullserv geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nullserv:v1.3.00792c7e6d814
stdlib@go1.16.5
1.24.12

Open the chart page →

1,119
nzbgetgeek-cookbookVerified publisher12.4.21 of 1See more

nzbget geek-cookbook 12.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbget:v21.1e5571acd10ce
stdlib@go1.18.4
1.24.12

Open the chart page →

12,599
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
stdlib@go1.15
1.24.12

Open the chart page →

18,047
owncloud-ocisgeek-cookbookVerified publisher2.4.21 of 1See more

owncloud-ocis geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
owncloud/ocis:1.7.0d2efcae92c84
stdlib@go1.16.5
1.24.12

Open the chart page →

3,257
photoprismgeek-cookbookVerified publisher7.2.01 of 1See more

photoprism geek-cookbook 7.2.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
photoprism/photoprism:220629-jammy2954334adbda
stdlib@go1.18.3
1.24.12

Open the chart page →

20,198
pod-gatewaygeek-cookbookVerified publisher5.6.21 of 2See more

pod-gateway geek-cookbook 5.6.2

1 of the 2 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/gateway-admision-controller:v3.5.0175512bb3f61
stdlib@go1.18.3
1.24.12

Open the chart page →

2,372
pod-gateway-settergeek-cookbookVerified publisher1.0.01 of 1See more

pod-gateway-setter geek-cookbook 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/gateway-admision-controller:v2.0.00d6d0df98fe4
stdlib@go1.16.4
1.24.12

Open the chart page →

1,645
qbittorrentgeek-cookbookVerified publisher13.5.21 of 1See more

qbittorrent geek-cookbook 13.5.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/qbittorrent:v4.4.261deadd1ec78
stdlib@go1.16.8
1.24.12

Open the chart page →

12,296
radarrgeek-cookbookVerified publisher16.3.21 of 1See more

radarr geek-cookbook 16.3.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/radarr:v4.1.0.61754273dfaf0295
stdlib@go1.18.4
1.24.12

Open the chart page →

10,792
readarrgeek-cookbookVerified publisher6.4.21 of 1See more

readarr geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/readarr:v0.1.0.715ad943e9309e4
stdlib@go1.15
1.24.12

Open the chart page →

7,950
satisfactorygeek-cookbookVerified publisher1.2.21 of 1See more

satisfactory geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
wolveix/satisfactory-server:lateste103700ae6ae
stdlib@go1.18.1
1.24.12

Open the chart page →

3,617
searxgeek-cookbookVerified publisher5.6.23 of 4See more

searx geek-cookbook 5.6.2

3 of the 4 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
dalf/filtron:latestb19cbf5b2f37
stdlib@go1.18.2
1.24.12
dalf/morty:latest248a4849c350
stdlib@go1.18.2
1.24.12
library/caddy:2.2.0-alpine7367adca165f
stdlib@go1.15.2
1.24.12

Open the chart page →

7,534
skypilotgeek-cookbookVerified publisher0.0.13 of 3See more

skypilot geek-cookbook 0.0.1

3 of the 3 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
stdlib@go1.23.5
1.24.12
registry.k8s.io/ingress-nginx/controller:v1.11.8695d79381ee6
stdlib@go1.24.4
1.24.12
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0c9f76a75fd00
stdlib@go1.24.4
1.24.12

Open the chart page →

9,501
torrservergeek-cookbookVerified publisher1.2.21 of 1See more

torrserver geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
smailkoz/torrserver:1.0.1117b52d15de8f0
stdlib@go1.17.5
1.24.12

Open the chart page →

3,163
transmissiongeek-cookbookVerified publisher8.4.31 of 1See more

transmission geek-cookbook 8.4.3

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/transmission:v3.006011182e3946
stdlib@go1.18.4
1.24.12

Open the chart page →

12,378
vikunjageek-cookbookVerified publisher6.2.02 of 4See more

vikunja geek-cookbook 6.2.0

2 of the 4 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
library/caddy:2.4.2-alpinefbc51bcf1ab0
stdlib@go1.16.5
1.24.12
vikunja/api:0.17.18cba0520bf8c
stdlib@go1.16.5
1.24.12

Open the chart page →

6,923
webhook-receivergeek-cookbookVerified publisher0.0.11 of 1See more

webhook-receiver geek-cookbook 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/geek-cookbook/webhook-receiver:2.8.172e7e77f8091
stdlib@go1.21.3
1.24.12

Open the chart page →

1,368
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
stdlib@go1.16.8
1.24.12

Open the chart page →

18,629
asynqmongeneral-helm-chartsVerified publisher0.0.11 of 1See more

asynqmon general-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
hibiken/asynqmon:latestac80bcffd2f9
stdlib@go1.18.10
1.24.12

Open the chart page →

753
chproxygeneral-helm-chartsVerified publisher0.0.21 of 1See more

chproxy general-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
contentsquareplatform/chproxy:v1.26.524555f22d4be
stdlib@go1.22.7
1.24.12

Open the chart page →

3,872
kafkagengxiankun-charts0.2.01 of 1See more

kafka gengxiankun-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
stdlib@go1.17.10
1.24.12

Open the chart page →

4,620
mongogengxiankun-charts0.1.01 of 1See more

mongo gengxiankun-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
library/mongo:5.041108d183e97
stdlib@go1.24.6
1.24.12

Open the chart page →

4,144
mysqlgengxiankun-charts0.2.01 of 1See more

mysql gengxiankun-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.24.12

Open the chart page →

476
genieacsgenieacsVerified publisher0.5.11 of 2See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
drumsergio/genieacs:1.2.16.028244054e1bf
stdlib@go1.19.8
1.24.12

Open the chart page →

4,469
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.82 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
stdlib@go1.19.11
1.24.12
postgis/postgis:11-2.5f479f6c3435e
stdlib@go1.16.7
1.24.12

Open the chart page →

35,617
istiogetindataVerified publisher1.11.12 of 2See more

istio getindata 1.11.1

2 of the 2 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
gcr.io/istio-release/pilot:1.11.1c552478f8f11
stdlib@go1.16.7
1.24.12
gcr.io/istio-release/proxyv2:1.11.19538fabe49fd
stdlib@go1.16.7
1.24.12

Open the chart page →

17,133
ghostghostVerified publisher0.1.02 of 4See more

ghost ghost 0.1.0

2 of the 4 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
stdlib@go1.18.2
1.24.12
litestream/litestream:0.3c5a1e1b01916
stdlib@go1.21.3
1.24.12

Open the chart page →

9,115
rabbitmqginger-society0.1.02 of 2See more

rabbitmq ginger-society 0.1.0

2 of the 2 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
kbudde/rabbitmq-exporter:latest12f27d6d84e6
stdlib@go1.21.8
1.24.12
library/rabbitmq:4-managementddc75301edf5
stdlib@go1.22.2
1.24.12

Open the chart page →

1,352
gitanagitana1.4.01 of 1See more

gitana gitana 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ntakashi/gitana:1.4.04171ec641120
stdlib@go1.17.7
1.24.12

Open the chart page →

4,079
github-rate-limits-prometheus-exportergithub-rate-limit-prometheus-exporterVerified publisher0.2.151 of 1See more

github-rate-limits-prometheus-exporter github-rate-limit-prometheus-exporter 0.2.15

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/kalgurn/grl-exporter:v3.2.0bd109b2bda38
stdlib@go1.23.5
1.24.12

Open the chart page →

888
gitlab-goproxygitlab-goproxy0.2.21 of 1See more

gitlab-goproxy gitlab-goproxy 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
ghcr.io/djcass44/gitlab-goproxy:v0.1.8a43323732181
stdlib@go1.21.0
1.24.12

Open the chart page →

1,332
apid-helpergkarthiks0.1.41 of 1See more

apid-helper gkarthiks 0.1.4

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
stdlib@go1.19.12
1.24.12

Open the chart page →

2,621
prometheus-container-resource-exportergkarthiks0.3.11 of 1See more

prometheus-container-resource-exporter gkarthiks 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-61728.

Container imageDigestPackageFixed in
gkarthics/container-resource-exporter:latest6799af333e8a
stdlib@go1.14.7
1.24.12

Open the chart page →

2,213

Container images carrying it

4,259 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
stdlib@go1.25.5
1.24.12
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
stdlib@go1.23.6
1.24.12
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
stdlib@go1.15
1.24.12
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
stdlib@go1.24.11
1.24.12
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
stdlib@go1.23.6
1.24.12
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
stdlib@go1.16.2
1.24.12
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.24.12
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.24.12
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.24.12
1

syft 1.42.1 · advisories as of 28 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.