CVE-2025-68973

High

Advisory

Published 28 Dec 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,054; of 17,828 indexed, latest versions
Container images: 2,332; deployed by those charts
Fix available: 5 of 5; affected packages

Red Hat Security Advisory: gnupg2 security update

Carried by container images the latest versions of 2,054 of 17,828 indexed charts deploy, on 2,332 images.

Affected package	Affected versions	Fixed in	Images
gnupg2deb	2.1.11-6ubuntu2.1, 2.2.4-1ubuntu1, 2.2.4-1ubuntu1.1, 2.2.4-1ubuntu1.2+23 more	2.1.11-6ubuntu2.1+esm3, 2.2.4-1ubuntu1.6+esm2, 2.2.19-3ubuntu2.5+esm1, 2.2.27-2+deb11u3+5 more	1,898
gnupg2rpm	2.0.22-5.el7_5, 2.2.9-1.el8, 2.2.20-2.el8, 2.2.20-3.el8_6+2 more	0:2.0.22-5.el7_9.1, 0:2.2.20-4.el8_10, 0:2.3.3-5.el9_7	335
gnupgdeb	1.4.16-1ubuntu2.1, 1.4.16-1ubuntu2.4, 1.4.16-1ubuntu2.6, 1.4.20-1ubuntu3.1+2 more	1.4.16-1ubuntu2.6+esm2, 1.4.20-1ubuntu3.3+esm3	76
gnupgapk	2.4.5-r0, 2.4.7-r0	2.4.9-r0	15
gpg2rpm	2.2.5-lp151.6.3.1, 2.2.5-lp152.8.8, 2.4.4-150600.3.9.1	2.4.4-150600.3.12.1, 2.5.16-1.1	9

OSV records: ALPINE-CVE-2025-68973 DEBIAN-CVE-2025-68973 RHSA-2026:0719 RHSA-2026:0728 RHSA-2026:1677 RLSA-2026:0719 RLSA-2026:0728 UBUNTU-CVE-2025-68973 DLA-4437-1 openSUSE-SU-2026:10001-1 SUSE-SU-2026:0215-1
Also known as: RHSA-2026:0935, RHSA-2026:0974, RHSA-2026:1014, RHSA-2026:1229, RHSA-2026:1230, RHSA-2026:1468, RHSA-2026:1705, USN-7946-1, USN-7946-2

Charts affected

2,054 by stars

Chart

Latest

Affected images

Radar Score

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	gnupg2@2.2.20-3.el8_6	0:2.2.20-4.el8_10

Open the chart page →

6,027

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3

Open the chart page →

1,839

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	gnupg2@2.2.20-3.el8_6	0:2.2.20-4.el8_10

Open the chart page →

3,702

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	gnupg2@2.2.4-1ubuntu1.4	2.2.4-1ubuntu1.6+esm2
yandex/clickhouse-server :21.3.20	4eccfffb01d7	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1

Open the chart page →

9,340

Container images carrying it

2,332 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
bitnamilegacy/valkey :8.1.3-debian-12-r3	4f0191fba7d3	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bitnamilegacy/valkey :8.1.3-debian-12-r1	a185655855b3	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bitnamilegacy/zookeeper :3.7.2-debian-11-r5	cbf54314c401	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
bitnamilegacy/zookeeper :3.8.1-debian-11-r6	dba59d740e13	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
bitnami/mariadb :11.7.2	16a7dae804fb	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bitnami/memcached :1.6.38	dd8f2cba9a5b	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bitnami/mongodb :8.0.8	b3bd5b6be9a0	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bitnami/redis :7.4.2	4e65bf641805	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
blackducksoftware/bdba-pgupgrader :2026.6.3	5c97f3a3f8b7	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
blakeblackshear/frigate :0.10.0-amd64	ae269270ad9e	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1	1
blockstream/bitcoind :27.2	9472492530e3	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bloxstaking/ssv-node :v2.2.0	bf6d7d2fdc93	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bmeares/meerschaum :2.8.4	8e9c5bacaa82	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
bnjbvr/kresus :0.22.1	37e216b182c8	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
boky/postfix :4.4.0	f3f247fd4252	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
boxcutter/meshcmd :1.1.3	84e13f01bcab	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1	1
bsgrigorov/helm-operator :latest	45ab095f09c8	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
btcpayserver/tor :0.4.8.10	e9585b68dc6b	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
buntha/mlflow :2.1.1	154542cc3083	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
calltelemetry/traceroute :0.7.2	70e3ff2429fe	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
calltelemetry/traceroute :0.7.1	7f43c019c087	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
calltelemetry/traceroute :0.6.7	8e35a409f565	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
calltelemetry/web :0.8.1-rc72	05d13269e350	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
calltelemetry/web :0.6.7	457a7e353542	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
camerahub/camerahub :0.36.23	a5af37dd6e1b	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
camunda/zeebe :8.4.5	ab5abc09e407	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
carlosmz87/test_helm_backend :latest	8ffa63aa995d	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
castlemock/castlemock :latest	b7f3f1527ba9	gnupg2@2.4.4-2ubuntu17	2.4.4-2ubuntu17.4	1
castopod/castopod :1.12.10	1fd37280cbb2	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
cbioportal/cbioportal :6.4.1-web-shenandoah	08debbd2dbf9	gnupg2@2.4.4-2ubuntu17.3	2.4.4-2ubuntu17.4	1
censedata/floating-server :v1.6.3	ebfffb9dd4c0	gnupg@2.4.7-r0	2.4.9-r0	1
ceresdb/ceresdb-server :v1.0.0	53b2d0dbba1f	gnupg2@2.2.19-3ubuntu2.2	2.2.19-3ubuntu2.5+esm1	1
cfcontainerization/cf-operator :v2.3.0-0.g27a91cdf	82fa261c18a8	gpg2@2.2.5-lp151.6.3.1	2.5.16-1.1	1
cfcontainerization/quarks-job :v0.0.0-0.g70ae34b	58fb1c173a46	gpg2@2.2.5-lp151.6.3.1	2.5.16-1.1	1
chaerr/kridge :demo-operator-v0.1.2	66833deec017	gnupg2@2.2.19-3ubuntu2.2	2.2.19-3ubuntu2.5+esm1	1
chainsafe/lodestar :v1.27.0	7b9fe4aa8073	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
chandanteekinavar/findery-market-order-service :1.0	0cf52bf5ee9a	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
chandanteekinavar/findery-market-product-service :1.0	c49ff7c141c0	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
chetangautamm/repo :Opensips_Build	b4b94155ff5a	gnupg@1.4.16-1ubuntu2.6	1.4.16-1ubuntu2.6+esm2	1
chetangautamm/repo :sipp.v3	e7f7049e1544	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1	1
cheveo/azp-agent :1.0.2	82240f890884	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
cheyang/distributed-tf :1.6.0	46cc34755493	gnupg@1.4.20-1ubuntu3.1	1.4.20-1ubuntu3.3+esm3	1
chriseaton/adventureworks :latest	54c3384ce701	gnupg2@2.2.27-3ubuntu2.3	2.2.27-3ubuntu2.5	1
chubaofs/cfs-client :3.2.0	15ff74209ce7	gnupg2@2.2.27-2	2.2.27-2+deb11u3	1
chubaofs/cfs-server :3.2.0	205030e045f2	gnupg2@2.2.27-2	2.2.27-2+deb11u3	1
circleci/runner :launch-agent	9bdc62f02162	gnupg2@2.2.19-3ubuntu2.2	2.2.19-3ubuntu2.5+esm1	1
ciscolabs/msm-nc :07102023	36d02faad958	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
citizenstig/httpbin :latest	b81c818ccb86	gnupg@1.4.20-1ubuntu3.1	1.4.20-1ubuntu3.3+esm3	1
ckulka/baikal :0.10.1-nginx	434bdd162247	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1