StackRadar

CVE-2025-66418

High

Advisory

Published 5 Dec 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
801
of 17,787 indexed, latest versions
Container images
845
deployed by those charts
Fix available
4 of 4
affected packages

urllib3 allows an unbounded number of links in the decompression chain

Carried by container images the latest versions of 801 of 17,787 indexed charts deploy, on 845 images.

Affected packageAffected versionsFixed inImages
urllib3pypi1.24, 1.24.1, 1.24.2, 1.24.3+42 more2.6.0818
py3-pipapk25.0.1-r0, 25.2-r0, 26.0.1-r126.1.1-r03
python-urllib3deb1.25.8-2ubuntu0.1, 1.25.8-2ubuntu0.2, 1.25.8-2ubuntu0.3, 1.25.8-2ubuntu0.4+6 more1.25.8-2ubuntu0.4+esm2, 1.26.5-1~exp1ubuntu0.4, 1.26.12-1+deb12u2, 2.0.7-1ubuntu0.346
python-pipdeb22.0.2+dfsg-1, 22.0.2+dfsg-1ubuntu0.2, 22.0.2+dfsg-1ubuntu0.3, 22.0.2+dfsg-1ubuntu0.4+7 more22.0.2+dfsg-1ubuntu0.7+esm1, 24.0+dfsg-1ubuntu1.3+esm144
OSV records
CGA-7c7g-v8c7-cp3hCGA-9p8r-r9mh-6fj5DEBIAN-CVE-2025-66418GHSA-gm62-xv2j-4w53UBUNTU-CVE-2025-66418
Also known as
CGA-8232-8863-qprx, CGA-f9vm-whvp-q74g, PYSEC-2026-1998, USN-7927-1, USN-8344-1

Charts affected

801 by stars
ChartLatestAffected imagesRadar Score
zerossl-cert-managerzerossl-cert-manager0.1.01 of 2See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-66418.

Container imageDigestPackageFixed in
andreymileshin/zerossl-issuer:v1.0.0e0825acc9e48
urllib3@2.4.0
2.6.0

Open the chart page →

569

Container images carrying it

845 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
urllib3@2.0.3
2.6.0
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
urllib3@2.3.0
2.6.0
1
ghcr.io/skyoo2003/digdag:0.0.1821fd6a6f2cd
urllib3@1.26.2
2.6.0
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
urllib3@1.26.12
2.6.0
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
urllib3@1.26.12
2.6.0
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
urllib3@2.3.0
2.6.0
1
ghcr.io/substra/substra-backend:1.0.121967f54ec86
urllib3@2.3.0
2.6.0
1
ghcr.io/sudo-kraken/authentik-webfinger-proxy:v1.1.1e1351a977607
urllib3@2.5.0
2.6.0
1
ghcr.io/sudo-kraken/fantasy-dice-chamber:v1.3.299fd4cb0f4fe
urllib3@2.5.0
2.6.0
1
ghcr.io/sudo-kraken/finances-tracker:v1.1.1c73527cde81c
urllib3@2.5.0
2.6.0
1
ghcr.io/sudo-kraken/jf-pushover-webhook:v1.1.0ee9cf22a39ab
urllib3@2.5.0
2.6.0
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
urllib3@1.26.20
2.6.0
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
urllib3@2.2.1
2.6.0
1
ghcr.io/texano00/urunner:0.6.07c8be1dae3cd
urllib3@1.26.20
2.6.0
1
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
urllib3@2.2.3
2.6.0
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
urllib3@2.5.0
2.6.0
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
urllib3@2.5.0
2.6.0
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
urllib3@1.26.12
python-urllib3@1.26.12-1
2.6.0
1.26.12-1+deb12u2
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
urllib3@2.0.7
2.6.0
1
ghcr.io/zazukoians/qlever-server:v0.10.0f10fd24b2290
python-pip@24.0+dfsg-1ubuntu1.3
24.0+dfsg-1ubuntu1.3+esm1
1
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
urllib3@2.3.0
2.6.0
1
mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.76e43ba0bd009
urllib3@2.0.7
2.6.0
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
urllib3@2.5.0
2.6.0
1
public.ecr.aws/k6v9y5g3/cluster-agent:master.57536d051110158
urllib3@2.3.0
2.6.0
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
urllib3@2.3.0
2.6.0
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
urllib3@2.2.3
2.6.0
1
public.ecr.aws/perfectscale-io/kube-state-metrics:4.1.14-redhat849e235e2d3e
urllib3@1.24.2
2.6.0
1
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
urllib3@1.26.5
2.6.0
1
public.ecr.aws/perfectscale-io/ubi9/ubi:9.5d7c3def9252b
urllib3@1.26.5
2.6.0
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
urllib3@1.25.8
python-urllib3@1.25.8-2ubuntu0.1
2.6.0
1.25.8-2ubuntu0.4+esm2
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
urllib3@1.26.5
2.6.0
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
urllib3@2.5.0
2.6.0
1
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
urllib3@1.26.18
2.6.0
1
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
urllib3@1.26.19
2.6.0
1
quay.io/cephcsi/cephcsi:v3.5.128a674af1df2
urllib3@1.24.2
2.6.0
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
urllib3@1.26.9
2.6.0
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
urllib3@1.24.2
2.6.0
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
urllib3@2.3.0
2.6.0
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
urllib3@1.24.2
2.6.0
1
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
urllib3@1.24.2
2.6.0
1
quay.io/everythingascode/apishift:v0.3.08fbbcd23b902
urllib3@1.26.5
2.6.0
1
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
urllib3@1.26.6
2.6.0
1
quay.io/fengyuanxing/zte_endogenous_security/kite-agent:V2.0.0734808044936
urllib3@1.24.2
2.6.0
1
quay.io/fiware/orion-ld:1.10.0b7ee7569a9a8
urllib3@1.24.2
2.6.0
1
quay.io/fiware/orion-ld:1.0.1ea838e5b4051
urllib3@1.24.2
2.6.0
1
quay.io/freeipa/freeipa-server:fedora-39-4.11.1d422ee50c2c3
urllib3@1.26.18
2.6.0
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
urllib3@2.4.0
2.6.0
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
urllib3@2.2.3
2.6.0
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
urllib3@1.26.2
2.6.0
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
urllib3@2.1.0
2.6.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.