StackRadar

CVE-2025-66418

High

Advisory

Published 5 Dec 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
801
of 17,787 indexed, latest versions
Container images
845
deployed by those charts
Fix available
4 of 4
affected packages

urllib3 allows an unbounded number of links in the decompression chain

Carried by container images the latest versions of 801 of 17,787 indexed charts deploy, on 845 images.

Affected packageAffected versionsFixed inImages
urllib3pypi1.24, 1.24.1, 1.24.2, 1.24.3+42 more2.6.0818
py3-pipapk25.0.1-r0, 25.2-r0, 26.0.1-r126.1.1-r03
python-urllib3deb1.25.8-2ubuntu0.1, 1.25.8-2ubuntu0.2, 1.25.8-2ubuntu0.3, 1.25.8-2ubuntu0.4+6 more1.25.8-2ubuntu0.4+esm2, 1.26.5-1~exp1ubuntu0.4, 1.26.12-1+deb12u2, 2.0.7-1ubuntu0.346
python-pipdeb22.0.2+dfsg-1, 22.0.2+dfsg-1ubuntu0.2, 22.0.2+dfsg-1ubuntu0.3, 22.0.2+dfsg-1ubuntu0.4+7 more22.0.2+dfsg-1ubuntu0.7+esm1, 24.0+dfsg-1ubuntu1.3+esm144
OSV records
CGA-7c7g-v8c7-cp3hCGA-9p8r-r9mh-6fj5DEBIAN-CVE-2025-66418GHSA-gm62-xv2j-4w53UBUNTU-CVE-2025-66418
Also known as
CGA-8232-8863-qprx, CGA-f9vm-whvp-q74g, PYSEC-2026-1998, USN-7927-1, USN-8344-1

Charts affected

801 by stars
ChartLatestAffected imagesRadar Score
zerossl-cert-managerzerossl-cert-manager0.1.01 of 2See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-66418.

Container imageDigestPackageFixed in
andreymileshin/zerossl-issuer:v1.0.0e0825acc9e48
urllib3@2.4.0
2.6.0

Open the chart page →

569

Container images carrying it

845 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
fiware/bae-activation-service:v0.0.33e3ec88d59ed
urllib3@1.26.2
2.6.0
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
urllib3@1.25.8
python-urllib3@1.25.8-2ubuntu0.4
2.6.0
1.25.8-2ubuntu0.4+esm2
1
fiware/orion-ld:1.10.03c490a746f65
urllib3@1.24.2
2.6.0
1
flag5/clustersecret:0.0.94ad5748bfcc6
urllib3@1.26.7
2.6.0
1
flagsmith/flagsmith-api:v2.6.0fd58556339a4
urllib3@1.25.11
2.6.0
1
flanksource/batch-runner:v1.0.44689687a7cf95
urllib3@2.5.0
2.6.0
1
fossology/fossology:4.2.18bd1f22ba7bb
urllib3@1.26.12
2.6.0
1
frankescobar/allure-docker-service:2.21.08a4d7e9308de
urllib3@1.25.11
2.6.0
1
frankescobar/allure-docker-service:2.19.0cafa03b94dac
urllib3@1.25.11
2.6.0
1
freeipa/freeipa-server:fedora-37-4.10.1c87d77342bf5
urllib3@1.26.18
2.6.0
1
galaxy/cloudman-server:lateste5c265fe9fcd
urllib3@1.26.12
2.6.0
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
urllib3@2.4.0
2.6.0
1
geonode/geoserver:2.28.4-latest81b1d431b7e9
python-pip@22.0.2+dfsg-1ubuntu0.7
22.0.2+dfsg-1ubuntu0.7+esm1
1
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
urllib3@1.25.10
2.6.0
1
gethue/hue:4.11.011b649636e68
urllib3@1.26.14
2.6.0
1
gethue/hue:4.10.05702b2c37ff9
urllib3@1.26.5
2.6.0
1
gethue/hue:latest7d5c1b9f8a79
python-pip@22.0.2+dfsg-1ubuntu0.6
22.0.2+dfsg-1ubuntu0.7+esm1
1
getsentry/sentry-kubernetes:latest6ac37974fd2a
urllib3@1.24.1
2.6.0
1
gluufederation/opendj:4.3.0_011a1128b28b95
urllib3@1.26.5
2.6.0
1
gmaas2/github-api:latest148fc2d9afe9
urllib3@1.26.13
2.6.0
1
gmelillo/registry:0.1.8c599d608a2f7
urllib3@1.26.18
2.6.0
1
goofball222/pritunl:1.30.3070.5943c0743701d4
urllib3@1.26.7
2.6.0
1
goofball222/pritunl:1.32.3602.807bf26032dfce
urllib3@1.26.14
2.6.0
1
gpappsoft/privacyidea-docker:3.12.2af7841adad26
urllib3@2.5.0
2.6.0
1
grafana/oncall:v1.16.5499851658393
urllib3@1.26.19
2.6.0
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
urllib3@1.25.9
2.6.0
1
greenbirdit/locust:0.9.0e99d53bdc944
urllib3@1.24.1
2.6.0
1
gristlabs/grist:0.7.96e71b1914a7e
urllib3@1.26.9
2.6.0
1
grpl/grapple-cli:0.2.127c00aafee6629
python-pip@24.0+dfsg-1ubuntu1
24.0+dfsg-1ubuntu1.3+esm1
1
guillh/web3-prometheus-exporter:0.3.04fb99dbc32b2
urllib3@2.2.2
2.6.0
1
gurolakman/oam:4.0.0ed8fd2062548
urllib3@1.24.2
2.6.0
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
urllib3@1.24.2
2.6.0
1
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
urllib3@1.24.2
2.6.0
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
urllib3@1.24.2
2.6.0
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
urllib3@1.24.2
2.6.0
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
urllib3@1.24.2
2.6.0
1
gurolakman/ussigw-core:1.0.48739565c3ea2
urllib3@1.24.2
2.6.0
1
halkeye/slack-resurrect:v0.1.477b05e95fdb5
urllib3@1.25.3
2.6.0
1
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
urllib3@2.2.3
2.6.0
1
hamzaarshad10/querypodpy:1.7154f38e8668e
urllib3@2.2.3
2.6.0
1
hansehe/locust:1.1.0bc8e45262bc4
urllib3@2.3.0
2.6.0
1
haveagitgat/tdarr:2.00.181256348872ce
urllib3@1.25.8
python-urllib3@1.25.8-2ubuntu0.1
2.6.0
1.25.8-2ubuntu0.4+esm2
1
haveagitgat/tdarr_node:2.00.101e3f9328327d
urllib3@1.25.8
python-urllib3@1.25.8-2ubuntu0.1
2.6.0
1.25.8-2ubuntu0.4+esm2
1
haveagitgat/tdarr_node:2.17.013ff0913202dd
urllib3@1.25.8
python-urllib3@1.25.8-2ubuntu0.2
2.6.0
1.25.8-2ubuntu0.4+esm2
1
hayk96/alerta-web:9.0.486377705e9e3
urllib3@2.3.0
2.6.0
1
hcguersoy/cleanreg:v0.8.063b76fdcfbe1
urllib3@1.26.8
2.6.0
1
healthchecks/healthchecks:v2.8.1e82bb0836e30
urllib3@1.26.15
2.6.0
1
hhyo/archery:v1.9.11aa41843419e
urllib3@1.26.12
2.6.0
1
hiboxsystems/marge-bot:0.11.07235809b43b3
urllib3@1.26.3
2.6.0
1
hiboxsystems/marge-bot:0.12.1a96c10b61a59
urllib3@2.0.4
2.6.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.