CVE-2025-66418
HighAdvisory
Published 5 Dec 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.9
- base score, highest
- EPSS
- 0.007
- 51st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 801
- of 17,787 indexed, latest versions
- Container images
- 845
- deployed by those charts
- Fix available
- 4 of 4
- affected packages
urllib3 allows an unbounded number of links in the decompression chain
Carried by container images the latest versions of 801 of 17,787 indexed charts deploy, on 845 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| urllib3pypi | 1.24, 1.24.1, 1.24.2, 1.24.3+42 more | 2.6.0 | 818 |
| py3-pipapk | 25.0.1-r0, 25.2-r0, 26.0.1-r1 | 26.1.1-r0 | 3 |
| python-urllib3deb | 1.25.8-2ubuntu0.1, 1.25.8-2ubuntu0.2, 1.25.8-2ubuntu0.3, 1.25.8-2ubuntu0.4+6 more | 1.25.8-2ubuntu0.4+esm2, 1.26.5-1~exp1ubuntu0.4, 1.26.12-1+deb12u2, 2.0.7-1ubuntu0.3 | 46 |
| python-pipdeb | 22.0.2+dfsg-1, 22.0.2+dfsg-1ubuntu0.2, 22.0.2+dfsg-1ubuntu0.3, 22.0.2+dfsg-1ubuntu0.4+7 more | 22.0.2+dfsg-1ubuntu0.7+esm1, 24.0+dfsg-1ubuntu1.3+esm1 | 44 |
- OSV records
- CGA-7c7g-v8c7-cp3hCGA-9p8r-r9mh-6fj5DEBIAN-CVE-2025-66418GHSA-gm62-xv2j-4w53UBUNTU-CVE-2025-66418
- Also known as
- CGA-8232-8863-qprx, CGA-f9vm-whvp-q74g, PYSEC-2026-1998, USN-7927-1, USN-8344-1
Charts affected
801 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| zerossl-cert-managerzerossl-cert-manager | 0.1.0 | 1 of 2See more | 569 |
Container images carrying it
845 by charts deploying them
A fixed version is listed for 4 of the 4 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| hiboxsystems/ | b59f01bc0418 | urllib3 | 2.6.0 | 1 |
| hiboxsystems/ | dcffb926e563 | urllib3 | 2.6.0 | 1 |
| hjacobs/ | 5d328c003efe | urllib3 | 2.6.0 | 1 |
| hjacobs/ | fbb303ed463c | urllib3 | 2.6.0 | 1 |
| hjacobs/ | a4fae38f93d7 | urllib3 | 2.6.0 | 1 |
| hjacobs/ | 45f93491c434 | urllib3 | 2.6.0 | 1 |
| hjacobs/ | c173cd02f5af | urllib3 | 2.6.0 | 1 |
| hjacobs/ | 431f1bf013d0 | urllib3 | 2.6.0 | 1 |
| hjacobs/ | b44a9cf81a2f | urllib3 | 2.6.0 | 1 |
| hkotel/ | a7e6b6abe087 | urllib3 | 2.6.0 | 1 |
| hmdmph/ | 79e4a170f3dc | urllib3 | 2.6.0 | 1 |
| hmdmph/ | 7f1381fe0f3b | urllib3 | 2.6.0 | 1 |
| homeassistant/ | 021e2afc6e57 | urllib3 | 2.6.0 | 1 |
| homeassistant/ | 8d000332b09b | urllib3 | 2.6.0 | 1 |
| i4trust/ | 9f3719176893 | urllib3 | 2.6.0 | 1 |
| ibmcom/ | d28bf361327a | urllib3 | 2.6.0 | 1 |
| ihatemoney/ | 457fda1feb32 | urllib3 | 2.6.0 | 1 |
| ilum/ | ce5dcdeb22ba | urllib3 | 2.6.0 | 1 |
| improwised/ | 97280b55cbd4 | urllib3 | 2.6.0 | 1 |
| intel/ | aa8f5483a2ef | urllib3 python-urllib3 | 2.6.0 1.25.8-2ubuntu0.4+esm2 | 1 |
| iosifache/ | 85df3f04b5da | urllib3 | 2.6.0 | 1 |
| istio/ | 6668bcf42ef0 | urllib3 | 2.6.0 | 1 |
| istio/ | 328b237e4fb1 | urllib3 | 2.6.0 | 1 |
| istio/ | 0a7f02b2c7c9 | urllib3 | 2.6.0 | 1 |
| jaedb/ | 048cfbf58d57 | urllib3 python-urllib3 | 2.6.0 1.26.12-1+deb12u2 | 1 |
| jamoos/ | 163e2e8a6e87 | urllib3 | 2.6.0 | 1 |
| jertel/ | 3cbf63f9b7dc | urllib3 | 2.6.0 | 1 |
| jertel/ | 4dcc0ef93efc | urllib3 | 2.6.0 | 1 |
| jmferrer/ | 030f68ec6998 | urllib3 | 2.6.0 | 1 |
| jordan/ | f75025fe8ea8 | urllib3 | 2.6.0 | 1 |
| josh5/ | 4d49c4816260 | urllib3 python-pip | 2.6.0 22.0.2+dfsg-1ubuntu0.7+esm1 | 1 |
| juicedata/ | 95008ba63318 | urllib3 | 2.6.0 | 1 |
| juicedata/ | d915e899e322 | urllib3 | 2.6.0 | 1 |
| julb/ | 837c4038a0dd | urllib3 | 2.6.0 | 1 |
| julb/ | d7d8836366ad | urllib3 | 2.6.0 | 1 |
| jupyterhub/ | 3974ba945e65 | python-pip | 24.0+dfsg-1ubuntu1.3+esm1 | 1 |
| jupyterhub/ | 5a0ceed1300a | urllib3 | 2.6.0 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | urllib3 | 2.6.0 | 1 |
| jupyterhub/ | e4770285aaf7 | urllib3 | 2.6.0 | 1 |
| jupyterhub/ | 8e4778efec8e | urllib3 | 2.6.0 | 1 |
| jupyterhub/ | e3e6f3051df8 | urllib3 | 2.6.0 | 1 |
| keitaro/ | 5bf1a45f45c1 | urllib3 | 2.6.0 | 1 |
| kelvinsp/ | cd33e6db2a59 | urllib3 | 2.6.0 | 1 |
| kfirfer/ | cf81d0959256 | urllib3 | 2.6.0 | 1 |
| kfirfer/ | e88cfcec5c93 | urllib3 | 2.6.0 | 1 |
| kfirfer/ | 81e5c4e5d70e | urllib3 | 2.6.0 | 1 |
| kfirfer/ | 461331bd838e | urllib3 | 2.6.0 | 1 |
| kfserving/ | f322d6ffdfa3 | urllib3 | 2.6.0 | 1 |
| kinseii/ | 7160eb143728 | urllib3 python-urllib3 | 2.6.0 1.26.12-1+deb12u2 | 1 |
| kiwigrid/ | 3e86186656d3 | urllib3 | 2.6.0 | 1 |