StackRadar

CVE-2025-63811

High

Advisory

Published 12 Nov 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.002
16th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
44
of 17,781 indexed, latest versions
Container images
41
deployed by those charts
Fix available
1 of 1
affected package

jose2go is vulnerable to a JWT bomb attack through its decode function

Carried by container images the latest versions of 44 of 17,781 indexed charts deploy, on 41 images.

Affected packageAffected versionsFixed inImages
github.com/dvsekhvalnov/jose2gogolangv0.0.0-20200901110807-248326c1351b, v1.5.0, v1.6.01.7.041
OSV records
GHSA-9mj6-hxhv-w67j
Also known as
GO-2025-4123

Charts affected

44 by stars
ChartLatestAffected imagesRadar Score
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

23,894
grafana-agentgrafana0.44.21 of 2See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/agent:v0.44.23364714a2f64
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

3,475
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
milvusdb/milvus:v2.2.13a3a55e1c1497
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

32,259
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,039
celestia-appcelestia-labsVerified publisher0.5.01 of 3See more

celestia-app celestia-labs 0.5.0

1 of the 3 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v3.7.0-arabica23a9ec9b1879
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,066
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

24,700
bentoself-hosters-by-nightVerified publisher0.9.11 of 1See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,046
boundaryboundary-chart0.3.121 of 1See more

boundary boundary-chart 0.3.12

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
hashicorp/boundary:0.15.3339b78b61750
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,624
celestia-nodecelestia-node0.1.71 of 1See more

celestia-node celestia-node 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.16.041177982c584
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,799
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.89.0995f17004231
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

15,383
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

3,518
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

4,389
prometheus-sql-exporterprometheus-communityVerified publisher0.5.01 of 1See more

prometheus-sql-exporter prometheus-community 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,199
sp-otel-collectorsp-otel-collectorVerified publisher1.1.61 of 1See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

2,022
boundaryundergridVerified publisher0.1.01 of 3See more

boundary undergrid 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
hashicorp/boundary:0.8.1fb70bd9210ff
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

4,957
vault-gcp-secretsvault-gcp-secrets1.19.51 of 1See more

vault-gcp-secrets vault-gcp-secrets 1.19.5

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

2,289
versitygw-webhook-pulsar-proxyalpineworks0.1.11 of 1See more

versitygw-webhook-pulsar-proxy alpineworks 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

893
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

28,131
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

13,459
pyroscopebook-k8sinfra-v21.10.01 of 3See more

pyroscope book-k8sinfra-v2 1.10.0

1 of the 3 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/alloy:v1.1.1c3dac4e26471
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

3,244
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

25,151
kube-ecp-stackemqx-operator2.5.11 of 16See more

kube-ecp-stack emqx-operator 2.5.1

1 of the 16 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
library/telegraf:1.27507a3eecf809
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

23,685
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

12,056
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

49,025
grafana-samplinggrafana1.1.71 of 2See more

grafana-sampling grafana 1.1.7

1 of the 2 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/alloy:v1.11.38c7256f412fe
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

3,318
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

8,188
armada-executorgresearch0.22.81 of 1See more

armada-executor gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
gresearch/armada-executor:latest393aff4aa8f2
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

707
armada-lookout-ingestergresearch0.22.81 of 1See more

armada-lookout-ingester gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
gresearch/armada-lookout-ingester:latest3df14cda1855
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

707
armada-lookout-migrationgresearch0.22.81 of 1See more

armada-lookout-migration gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
gresearch/armada-lookout:latestf5e3226f1d33
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

707
armada-scheduler-migrationgresearch0.22.81 of 1See more

armada-scheduler-migration gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
gresearch/armada-scheduler:latest6141a6213fcb
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

707
ilum-otel-collectorilumVerified publisher0.1.01 of 1See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,384
sql-exporterjdstoneVerified publisher0.2.11 of 1See more

sql-exporter jdstone 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
burningalchemist/sql_exporter:0.16.0b8e4757c7def
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

885
vaultjfrog0.25.01 of 2See more

vault jfrog 0.25.0

1 of the 2 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
hashicorp/vault:1.14.0b2177a8bfe85
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

3,968
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b
1.7.0

Open the chart page →

19,168
vaultkubeblocksVerified publisher0.30.01 of 2See more

vault kubeblocks 0.30.0

1 of the 2 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
hashicorp/vault:1.19.0bbb7f98dc67d
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

2,742
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

20,204
cachelavaOfficialVerified publisher1.1.11 of 1See more

cache lava 1.1.1

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/lavanet/lava/lavap:v2.5.089028adefcff
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,378
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

21,064
chirpstack-event-forwardmosquitto-helm-chart0.1.21 of 1See more

chirpstack-event-forward mosquitto-helm-chart 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/chirpstack-event-forward:v0.1.223dc6274cc4b
github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b
1.7.0

Open the chart page →

1,854
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

7,309
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

4,127
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0

Open the chart page →

1,721
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

14,983
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2025-63811.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0

Open the chart page →

2,022

Container images carrying it

41 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/alloy:v1.8.17790f6f7fbd8
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
2
hashicorp/vault:1.15.26b4e5dadf082
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
2
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
2
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
burningalchemist/sql_exporter:0.16.0b8e4757c7def
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
grafana/agent:v0.44.23364714a2f64
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
grafana/agent:v0.40.3f6cbec9409be
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
grafana/alloy:v1.5.101a63f4e032c
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
grafana/alloy:v1.4.306bdcbb51fc2
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
grafana/alloy:v1.11.38c7256f412fe
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
grafana/alloy:v1.1.1c3dac4e26471
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
gresearch/armada-executor:latest393aff4aa8f2
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
gresearch/armada-lookout:latestf5e3226f1d33
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
gresearch/armada-lookout-ingester:latest3df14cda1855
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
gresearch/armada-scheduler:latest6141a6213fcb
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
hashicorp/boundary:0.15.3339b78b61750
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
hashicorp/boundary:0.8.1fb70bd9210ff
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
hashicorp/vault:1.15.40b01ed3924e6
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
hashicorp/vault:1.14.0b2177a8bfe85
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
hashicorp/vault:1.19.0bbb7f98dc67d
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
library/telegraf:1.27507a3eecf809
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
milvusdb/milvus:v2.2.13a3a55e1c1497
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
otel/opentelemetry-collector-contrib:0.89.0995f17004231
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b
1.7.0
1
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
ghcr.io/celestiaorg/celestia-app:v3.7.0-arabica23a9ec9b1879
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
ghcr.io/celestiaorg/celestia-node:v0.16.041177982c584
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
ghcr.io/lavanet/lava/lavap:v2.5.089028adefcff
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
ghcr.io/liangyuanpeng/chirpstack-event-forward:v0.1.223dc6274cc4b
github.com/dvsekhvalnov/jose2go@v0.0.0-20200901110807-248326c1351b
1.7.0
1
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/dvsekhvalnov/jose2go@v1.6.0
1.7.0
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/dvsekhvalnov/jose2go@v1.5.0
1.7.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.