StackRadar

CVE-2025-66418

High

Advisory

Published 5 Dec 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
801
of 17,787 indexed, latest versions
Container images
845
deployed by those charts
Fix available
4 of 4
affected packages

urllib3 allows an unbounded number of links in the decompression chain

Carried by container images the latest versions of 801 of 17,787 indexed charts deploy, on 845 images.

Affected packageAffected versionsFixed inImages
urllib3pypi1.24, 1.24.1, 1.24.2, 1.24.3+42 more2.6.0818
py3-pipapk25.0.1-r0, 25.2-r0, 26.0.1-r126.1.1-r03
python-urllib3deb1.25.8-2ubuntu0.1, 1.25.8-2ubuntu0.2, 1.25.8-2ubuntu0.3, 1.25.8-2ubuntu0.4+6 more1.25.8-2ubuntu0.4+esm2, 1.26.5-1~exp1ubuntu0.4, 1.26.12-1+deb12u2, 2.0.7-1ubuntu0.346
python-pipdeb22.0.2+dfsg-1, 22.0.2+dfsg-1ubuntu0.2, 22.0.2+dfsg-1ubuntu0.3, 22.0.2+dfsg-1ubuntu0.4+7 more22.0.2+dfsg-1ubuntu0.7+esm1, 24.0+dfsg-1ubuntu1.3+esm144
OSV records
CGA-7c7g-v8c7-cp3hCGA-9p8r-r9mh-6fj5DEBIAN-CVE-2025-66418GHSA-gm62-xv2j-4w53UBUNTU-CVE-2025-66418
Also known as
CGA-8232-8863-qprx, CGA-f9vm-whvp-q74g, PYSEC-2026-1998, USN-7927-1, USN-8344-1

Charts affected

801 by stars
ChartLatestAffected imagesRadar Score
zerossl-cert-managerzerossl-cert-manager0.1.01 of 2See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-66418.

Container imageDigestPackageFixed in
andreymileshin/zerossl-issuer:v1.0.0e0825acc9e48
urllib3@2.4.0
2.6.0

Open the chart page →

569

Container images carrying it

845 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
buntha/mlflow:2.1.1154542cc3083
urllib3@1.26.13
2.6.0
1
camerahub/camerahub:0.36.23a5af37dd6e1b
urllib3@1.26.15
2.6.0
1
camptocamp/bucket-cloner:latestacfafc308d88
urllib3@1.26.6
2.6.0
1
camptocamp/ekorre:0.1.035c91d5fda04
urllib3@1.25.8
2.6.0
1
camptocamp/pghoard:10bff736b15623
urllib3@1.24.1
2.6.0
1
camptocamp/snow-webhook:latest2924b43dbf40
urllib3@1.24.1
2.6.0
1
cdignam/kodiak:v0.54.05a6a55b39cee
urllib3@1.26.9
2.6.0
1
chetangautamm/repo:sipp.v3e7f7049e1544
urllib3@1.25.8
python-urllib3@1.25.8-2ubuntu0.1
2.6.0
1.25.8-2ubuntu0.4+esm2
1
chubaofs/cfs-client:3.2.015ff74209ce7
urllib3@1.26.8
2.6.0
1
chubaofs/cfs-server:3.2.0205030e045f2
urllib3@1.26.8
2.6.0
1
ciuse99/suggestarr:v1.0.20d72768245ef5
urllib3@2.2.3
2.6.0
1
ckan/ckan-base-datapusher:0.0.2184d11924549f
urllib3@1.26.5
2.6.0
1
cleveritcz/opencve:1.5.0c75c1636e0b7
urllib3@1.25.11
2.6.0
1
cloudve/janis-terminal:latestaf56e77ca587
urllib3@1.25.9
2.6.0
1
cloudve/ttyd:latestd79c1c5881c0
urllib3@1.25.8
2.6.0
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
urllib3@1.26.20
2.6.0
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
urllib3@1.26.20
2.6.0
1
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
urllib3@1.26.20
2.6.0
1
codaprotocol/buildkite-exporter:0.2.137c68e67a401
urllib3@1.26.3
2.6.0
1
codaprotocol/coda-user-agent:0.1.54ba4dd3a041f
urllib3@1.25.9
2.6.0
1
codecov/self-hosted-api:24.4.10475cb1c3136
urllib3@1.26.18
2.6.0
1
codecov/self-hosted-worker:24.4.1837f546b479b
urllib3@1.26.18
2.6.0
1
confluentinc/cp-enterprise-control-center:6.1.0f2975d507a2a
urllib3@1.26.3
2.6.0
1
confluentinc/cp-enterprise-kafka:6.1.08f1544df1f48
urllib3@1.26.3
2.6.0
1
confluentinc/cp-kafka:7.1.2.amd643bf359d5e340
urllib3@1.26.9
2.6.0
1
confluentinc/cp-kafka:7.6.683dbca3efd2a
urllib3@2.4.0
2.6.0
1
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
urllib3@2.2.3
2.6.0
1
confluentinc/cp-kafka:7.4.4c0224a1adf7a
urllib3@2.1.0
2.6.0
1
confluentinc/cp-kafka:7.5.1dc9b972db002
urllib3@2.0.5
2.6.0
1
confluentinc/cp-kafka-connect:6.1.04bc70a83ca6f
urllib3@1.26.3
2.6.0
1
confluentinc/cp-kafka-rest:6.1.0b0b7aa26254a
urllib3@1.26.3
2.6.0
1
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
urllib3@2.2.0
2.6.0
1
confluentinc/cp-ksqldb-server:6.1.0ee403d5b9090
urllib3@1.26.3
2.6.0
1
confluentinc/cp-schema-registry:6.1.0b651d4b6185a
urllib3@1.26.3
2.6.0
1
confluentinc/cp-zookeeper:7.5.10bec03c1f3ce
urllib3@2.0.5
2.6.0
1
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
urllib3@2.2.3
2.6.0
1
confluentinc/cp-zookeeper:6.1.078c190f4472c
urllib3@1.26.3
2.6.0
1
countly/countly-server:25.05.4e3c238248f99
urllib3@1.25.8
python-urllib3@1.25.8-2ubuntu0.1
2.6.0
1.25.8-2ubuntu0.4+esm2
1
cr0hn/ja-shortener:v0.1.414482d0bc4a1
urllib3@2.4.0
2.6.0
1
craigwillis/c2metadata-bd:latestae317d7e4724
urllib3@1.26.1
2.6.0
1
crazymax/rtorrent-rutorrent:3.10-0.9.8-0.13.8fb307f5b87bf
urllib3@1.26.13
2.6.0
1
danialnabiyan1382/lsdisk:v2.0.8f96a7ebf1f42
urllib3@2.3.0
2.6.0
1
danuk/telegram-sender:0.0.1026560388070
urllib3@1.26.12
2.6.0
1
daskdev/dask-notebook:1.1.0052630f5ca04
urllib3@1.24.1
2.6.0
1
datadog/agent:7.22.08f20e56b5311
urllib3@1.25.10
2.6.0
1
datadog/agent:6aad9994de6a7
urllib3@1.26.20
2.6.0
1
datamate/seafile-professional:11.0.202dd66b722464
urllib3@1.26.18
python-pip@22.0.2+dfsg-1ubuntu0.6
2.6.0
22.0.2+dfsg-1ubuntu0.7+esm1
1
datawire/aes:2.0.3-ea07f8fe4f4f8e
urllib3@1.26.3
2.6.0
1
datawire/aes:1.13.62beb65062c8b
urllib3@1.26.3
2.6.0
1
datawire/aes:3.11.195ec30b3c732
urllib3@2.2.1
2.6.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.