CVE-2025-68973

High

Advisory

Published 28 Dec 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,054; of 17,828 indexed, latest versions
Container images: 2,332; deployed by those charts
Fix available: 5 of 5; affected packages

Red Hat Security Advisory: gnupg2 security update

Carried by container images the latest versions of 2,054 of 17,828 indexed charts deploy, on 2,332 images.

Affected package	Affected versions	Fixed in	Images
gnupg2deb	2.1.11-6ubuntu2.1, 2.2.4-1ubuntu1, 2.2.4-1ubuntu1.1, 2.2.4-1ubuntu1.2+23 more	2.1.11-6ubuntu2.1+esm3, 2.2.4-1ubuntu1.6+esm2, 2.2.19-3ubuntu2.5+esm1, 2.2.27-2+deb11u3+5 more	1,898
gnupg2rpm	2.0.22-5.el7_5, 2.2.9-1.el8, 2.2.20-2.el8, 2.2.20-3.el8_6+2 more	0:2.0.22-5.el7_9.1, 0:2.2.20-4.el8_10, 0:2.3.3-5.el9_7	335
gnupgdeb	1.4.16-1ubuntu2.1, 1.4.16-1ubuntu2.4, 1.4.16-1ubuntu2.6, 1.4.20-1ubuntu3.1+2 more	1.4.16-1ubuntu2.6+esm2, 1.4.20-1ubuntu3.3+esm3	76
gnupgapk	2.4.5-r0, 2.4.7-r0	2.4.9-r0	15
gpg2rpm	2.2.5-lp151.6.3.1, 2.2.5-lp152.8.8, 2.4.4-150600.3.9.1	2.4.4-150600.3.12.1, 2.5.16-1.1	9

OSV records: ALPINE-CVE-2025-68973 DEBIAN-CVE-2025-68973 RHSA-2026:0719 RHSA-2026:0728 RHSA-2026:1677 RLSA-2026:0719 RLSA-2026:0728 UBUNTU-CVE-2025-68973 DLA-4437-1 openSUSE-SU-2026:10001-1 SUSE-SU-2026:0215-1
Also known as: RHSA-2026:0935, RHSA-2026:0974, RHSA-2026:1014, RHSA-2026:1229, RHSA-2026:1230, RHSA-2026:1468, RHSA-2026:1705, USN-7946-1, USN-7946-2

Charts affected

2,054 by stars

Chart

Latest

Affected images

Radar Score

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	gnupg2@2.2.20-3.el8_6	0:2.2.20-4.el8_10

Open the chart page →

6,027

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3

Open the chart page →

1,839

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	gnupg2@2.2.20-3.el8_6	0:2.2.20-4.el8_10

Open the chart page →

3,702

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	gnupg2@2.2.4-1ubuntu1.4	2.2.4-1ubuntu1.6+esm2
yandex/clickhouse-server :21.3.20	4eccfffb01d7	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1

Open the chart page →

9,340

Container images carrying it

2,332 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
countly/frontend :25.05.4	2acbc11499b6	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
cradlepoint/pgbouncer :1.0.1	8f5720b0cd03	gnupg2@2.2.4-1ubuntu1.1	2.2.4-1ubuntu1.6+esm2	1
craftypath/sops-operator :v0.8.0	402a0024c732	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
crate/crate-operator :2.43.1	ea396813f6f0	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
cribl/cribl :3.0.2	762747cb6796	gnupg2@2.2.4-1ubuntu1.4	2.2.4-1ubuntu1.6+esm2	1
crowdfox/external-service-operator :v1.1.0	6fa7e8063d27	gnupg2@2.0.22-5.el7_5	0:2.0.22-5.el7_9.1	1
csiplugin/csi-neonsan :v1.2.2	1fa83d45417f	gnupg@1.4.20-1ubuntu3.3	1.4.20-1ubuntu3.3+esm3	1
ctron/hawkbit-operator :0.1.4	8fdea8f76499	gnupg2@2.2.9-1.el8	0:2.2.20-4.el8_10	1
cubejs/cubestore :v1.5.3	34ac523a9bab	gnupg2@2.2.40-1.1+deb12u1	2.2.40-1.1+deb12u2	1
cyclonedx/cyclonedx-bom-repo-server :latest	9e0c4db6e688	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
dachichang/basic-auth-s3-nginx :1.0.0	7ccac90a935e	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
daedalusproject/base_kubectl :latest	6f72b5119eda	gnupg2@2.2.19-3ubuntu2	2.2.19-3ubuntu2.5+esm1	1
danialnabiyan1382/lsdisk :v2.0.8	f96a7ebf1f42	gnupg2@2.2.40-1.1+deb12u1	2.2.40-1.1+deb12u2	1
dannielkil/book-backend :latest	e3b479a55a69	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
dannielkil/book-frontend :latest	937993927694	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
danuk/k8s-sftp-gcs :latest	dd0e6585c44f	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
danuk/telegram-sender :0.0.1	026560388070	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
darkobas/ethexporter :latest	62e6464491ba	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
darkobas/tokenexporter :latest	a0349a0eedf0	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
darthsim/imgproxy :v3.30.1	3b709e4a0e5e	gnupg2@2.4.4-2ubuntu17.3	2.4.4-2ubuntu17.4	1
darthsim/imgproxy :v3.15.0	40f6eb807444	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
darthsim/imgproxy :v3.26	476cb08c816a	gnupg2@2.4.4-2ubuntu17	2.4.4-2ubuntu17.4	1
darthsim/imgproxy :v3.29.1	7d12c7c8fc66	gnupg2@2.4.4-2ubuntu17.3	2.4.4-2ubuntu17.4	1
daskdev/dask-notebook :1.1.0	052630f5ca04	gnupg2@2.2.4-1ubuntu1.1	2.2.4-1ubuntu1.6+esm2	1
dasmeta/mongodb-bi-connector :1.0.3	fa657960dfec	gnupg2@2.2.4-1ubuntu1.6	2.2.4-1ubuntu1.6+esm2	1
datadog/agent :6	aad9994de6a7	gnupg2@2.4.4-2ubuntu17	2.4.4-2ubuntu17.4	1
datadog/extendeddaemonset :v0.8.0	513a4377aed5	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
datadog/operator :0.3.1	17f08a860090	gnupg2@2.0.22-5.el7_5	0:2.0.22-5.el7_9.1	1
datafuselabs/databend-meta :v1.2.279	ba877ee6cb4d	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
datafuselabs/databend-query :v1.2.279	a936843b85b4	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
datalayers/datalayers :v2.2.10	17b292079239	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
datalust/seq :5.0.832-pre	9c731bb207a6	gnupg@1.4.20-1ubuntu3.1	1.4.20-1ubuntu3.3+esm3	1
datalust/seq-input-gelf :3.0.441-x64	3de34aed5642	gnupg2@2.2.19-3ubuntu2.2	2.2.19-3ubuntu2.5+esm1	1
datamate/seafile-professional :11.0.20	2dd66b722464	gnupg2@2.2.27-3ubuntu2.4	2.2.27-3ubuntu2.5	1
datappeal/hive-metastore :latest	e38c085a3567	gnupg2@2.2.27-2	2.2.27-2+deb11u3	1
datawire/ambassador-operator :v1.3.0	f95ae710d75c	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
davidvmar/urjc-davidvmar-worker :1.0.1	0d221e834a21	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
dbeaver/cloudbeaver :21.3.0	0c0985098263	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1	1
dblaci/ubuntu-ssh-rsync :20231020	eea697611af4	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
ddosify/alaz :v0.12.0	ea602056d9ce	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ddosify/selfhosted_alaz_backend :1.0.6	a43c5155fa1c	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ddosify/selfhosted_alaz_backend :2.3.11	e5be48b37348	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ddosify/selfhosted_backend :3.2.9	3c11e3182652	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ddosify/selfhosted_backend :2.6.11	ac323d52bfb4	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ddosify/selfhosted_hammermanager :1.2.4	71b8768f49bc	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ddosify/selfhosted_hammermanager :2.0.2	b796b8c73011	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
deconzcommunity/deconz :2.29.2	062de2362641	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
deepflowce/deepflow-agent :v6.2.6.5	29332fee7fc2	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
defactops/defactops-backend :1.0.23	07b663c0092a	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
dellcloud/category :distributed	02fc234353a9	gnupg2@2.2.19-3ubuntu2	2.2.19-3ubuntu2.5+esm1	1