StackRadar

CVE-2025-61921

Medium

Advisory

Published 10 Oct 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
14
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
1 of 1
affected package

Sinatra is vulnerable to ReDoS through ETag header value generation

Carried by container images the latest versions of 14 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
sinatragem1.4.8, 2.0.1, 2.0.5, 2.0.8.1+7 more4.2.018
OSV records
GHSA-mr3q-g2mv-mr4q

Charts affected

14 by stars
ChartLatestAffected imagesRadar Score
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
sinatra@2.2.4
4.2.0

Open the chart page →

10,530
pact-brokeralmorgvVerified publisher0.1.01 of 1See more

pact-broker almorgv 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.79.1.112861b0bd4d9
sinatra@2.1.0
4.2.0

Open the chart page →

4,995
gollumgeek-cookbookVerified publisher3.4.21 of 3See more

gollum geek-cookbook 3.4.2

1 of the 3 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
gollumorg/gollum:latest7cd5305a3cf7
sinatra@2.1.0
4.2.0

Open the chart page →

4,629
opennebulakvaps2.1.15 of 9See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
sinatra@2.0.8.1
4.2.0
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
sinatra@2.0.8.1
4.2.0
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
sinatra@2.0.8.1
4.2.0
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
sinatra@2.0.8.1
4.2.0
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
sinatra@2.0.8.1
4.2.0

Open the chart page →

113,791
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
sinatra@2.2.1
4.2.0

Open the chart page →

7,529
honeywell-exporterbryanalves0.1.11 of 1See more

honeywell-exporter bryanalves 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
sinatra@2.0.1
4.2.0

Open the chart page →

5,437
smart-exporterbryanalves0.2.21 of 1See more

smart-exporter bryanalves 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
bryanalves/smart_exporter:0.2af47dfbb9413
sinatra@2.0.5
4.2.0

Open the chart page →

4,131
showoffcamptocamp31.0.01 of 1See more

showoff camptocamp3 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
binford2k/showoff:0.20.2a64937052ce7
sinatra@1.4.8
4.2.0

Open the chart page →

1,584
puppet-forgecloudnativeapp0.1.81 of 2See more

puppet-forge cloudnativeapp 0.1.8

1 of the 2 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
hickey/puppet_forge:1.10.0c1148a09ef20
sinatra@1.4.8
4.2.0

Open the chart page →

4,086
pact-brokercloud-native-toolkit0.3.01 of 1See more

pact-broker cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.101.0.0a3021fc42834
sinatra@2.2.0
4.2.0

Open the chart page →

2,814
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
sinatra@4.1.1
4.2.0

Open the chart page →

2,942
yelbfairwinds-incubator0.1.11 of 5See more

yelb fairwinds-incubator 0.1.1

1 of the 5 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
quay.io/fairwinds/yelb-appserver:v0.6.0fae21f06131f
sinatra@3.2.0
4.2.0

Open the chart page →

5,089
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
sinatra@3.1.0
4.2.0

Open the chart page →

49,025
pact-brokerqamatic0.1.01 of 2See more

pact-broker qamatic 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-61921.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.32.0-2062d6c710099
sinatra@2.0.5
4.2.0

Open the chart page →

3,533

Container images carrying it

18 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
binford2k/showoff:0.20.2a64937052ce7
sinatra@1.4.8
4.2.0
1
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
sinatra@2.0.1
4.2.0
1
bryanalves/smart_exporter:0.2af47dfbb9413
sinatra@2.0.5
4.2.0
1
gollumorg/gollum:latest7cd5305a3cf7
sinatra@2.1.0
4.2.0
1
hickey/puppet_forge:1.10.0c1148a09ef20
sinatra@1.4.8
4.2.0
1
library/logstash:7.17.817a4f64e9cf5
sinatra@2.2.1
4.2.0
1
library/logstash:9.1.233eae14f0867
sinatra@4.1.1
4.2.0
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
sinatra@2.2.4
4.2.0
1
pactfoundation/pact-broker:2.32.0-2062d6c710099
sinatra@2.0.5
4.2.0
1
pactfoundation/pact-broker:2.79.1.112861b0bd4d9
sinatra@2.1.0
4.2.0
1
pactfoundation/pact-broker:2.101.0.0a3021fc42834
sinatra@2.2.0
4.2.0
1
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
sinatra@2.0.8.1
4.2.0
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
sinatra@2.0.8.1
4.2.0
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
sinatra@2.0.8.1
4.2.0
1
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
sinatra@2.0.8.1
4.2.0
1
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
sinatra@2.0.8.1
4.2.0
1
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
sinatra@3.1.0
4.2.0
1
quay.io/fairwinds/yelb-appserver:v0.6.0fae21f06131f
sinatra@3.2.0
4.2.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.