CVE-2025-68973

High

Advisory

Published 28 Dec 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,055; of 17,832 indexed, latest versions
Container images: 2,326; deployed by those charts
Fix available: 5 of 5; affected packages

Red Hat Security Advisory: gnupg2 security update

Carried by container images the latest versions of 2,055 of 17,832 indexed charts deploy, on 2,326 images.

Affected package	Affected versions	Fixed in	Images
gnupg2deb	2.1.11-6ubuntu2.1, 2.2.4-1ubuntu1, 2.2.4-1ubuntu1.1, 2.2.4-1ubuntu1.2+23 more	2.1.11-6ubuntu2.1+esm3, 2.2.4-1ubuntu1.6+esm2, 2.2.19-3ubuntu2.5+esm1, 2.2.27-2+deb11u3+5 more	1,895
gnupg2rpm	2.0.22-5.el7_5, 2.2.9-1.el8, 2.2.20-2.el8, 2.2.20-3.el8_6+2 more	0:2.0.22-5.el7_9.1, 0:2.2.20-4.el8_10, 0:2.3.3-5.el9_7	332
gnupgdeb	1.4.16-1ubuntu2.1, 1.4.16-1ubuntu2.4, 1.4.16-1ubuntu2.6, 1.4.20-1ubuntu3.1+2 more	1.4.16-1ubuntu2.6+esm2, 1.4.20-1ubuntu3.3+esm3	76
gnupgapk	2.4.5-r0, 2.4.7-r0	2.4.9-r0	15
gpg2rpm	2.2.5-lp151.6.3.1, 2.2.5-lp152.8.8, 2.4.4-150600.3.9.1	2.4.4-150600.3.12.1, 2.5.16-1.1	9

OSV records: ALPINE-CVE-2025-68973 DEBIAN-CVE-2025-68973 RHSA-2026:0719 RHSA-2026:0728 RHSA-2026:1677 RLSA-2026:0719 RLSA-2026:0728 UBUNTU-CVE-2025-68973 DLA-4437-1 openSUSE-SU-2026:10001-1 SUSE-SU-2026:0215-1
Also known as: RHSA-2026:0935, RHSA-2026:0974, RHSA-2026:1014, RHSA-2026:1229, RHSA-2026:1230, RHSA-2026:1468, RHSA-2026:1705, USN-7946-1, USN-7946-2

Charts affected

2,055 by stars

Chart

Latest

Affected images

Radar Score

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2

Open the chart page →

2,709

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	gnupg2@2.2.20-3.el8_6	0:2.2.20-4.el8_10

Open the chart page →

6,027

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3

Open the chart page →

1,839

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	gnupg2@2.2.20-3.el8_6	0:2.2.20-4.el8_10

Open the chart page →

3,702

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-68973.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	gnupg2@2.2.4-1ubuntu1.4	2.2.4-1ubuntu1.6+esm2
yandex/clickhouse-server :21.3.20	4eccfffb01d7	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1

Open the chart page →

9,340

Container images carrying it

2,326 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/astriaorg/evm-bridge-withdrawer :1.0.2	9c88e1aff357	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/astriaorg/hermes :0.5.0	4f33a0a9f75e	gnupg2@2.4.4-2ubuntu17	2.4.4-2ubuntu17.4	1
ghcr.io/astriaorg/sequencer :latest	44f82ee0b24c	gnupg2@2.2.40-1.1+deb12u1	2.2.40-1.1+deb12u2	1
ghcr.io/astriaorg/sequencer-relayer :latest	5f6c74993f08	gnupg2@2.2.40-1.1+deb12u1	2.2.40-1.1+deb12u2	1
ghcr.io/avistotelecom/docker-wazuh-agent :4.12.0	8766ba08bf1a	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/base-org/node :v0.11.1	1aba0ffe55ea	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
ghcr.io/beluga-cloud/jellyfin/jellyfin :10.8.13	68f52b993a7f	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
ghcr.io/beslovas/duckdb-ui :1.3.2	72f35584026d	gnupg2@2.2.40-1.1+deb12u1	2.2.40-1.1+deb12u2	1
ghcr.io/blakeblackshear/frigate :0.14.1	22e3d0b486df	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/blakeblackshear/frigate :0.13.0	7a5244e4c8dc	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/blakeblackshear/frigate :0.12.0	c862771e38e8	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/botify-labs/airbyte_exporter :2.3.0	2105b1f33013	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	gnupg2@2.2.19-3ubuntu2.2	2.2.19-3ubuntu2.5+esm1	1
ghcr.io/buanet/iobroker :v9.1.2	ca7dc7362968	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/camptocamp/tetragon-policy-builder :master	0e99f12bb040	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/camunda-community-hub/zeebe-simple-monitor :2.6.2	d9d796a1b846	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/chaos-mesh/chaos-daemon :v2.7.2	9608d9b51452	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/chaos-mesh/chaos-daemon :v2.8.0	fb609bc264d9	gnupg2@2.2.40-1.1+deb12u1	2.2.40-1.1+deb12u2	1
ghcr.io/chaos-mesh/chaos-dashboard :v2.7.2	11cdbbc479b3	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/chaos-mesh/chaos-dashboard :v2.8.0	e7f9e8f1d565	gnupg2@2.2.40-1.1+deb12u1	2.2.40-1.1+deb12u2	1
ghcr.io/chatwoot/pgvector :14.4.0-debian-11-r0	f759f1510d09	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/cloudnative-pg/postgresql :14.5	b3b30d04b362	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/codingducksrl/wordpress :6.0.2	3113c0960507	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/colenio/slo-reporting :0.3.31	6b64d194a27d	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/conductionnl/berichtservice-nginx :latest	833d26df3840	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/contactcatalogus-nginx :latest	480c84fa9e63	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/digispoof-interface-nginx :latest	8fa4597217a4	gnupg2@2.2.27-2	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/eav-component-nginx :latest	d785c893096c	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/education-component-nginx :latest	38900bc76ee0	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/medewerkercatalogus-nginx :latest	06c3b27462e6	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/skeleton-pip :dev	ce1ebe9387a2	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/user-component-nginx :latest	b721579df8c3	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/waardepapieren-nginx :latest	af31cf6cd59f	gnupg2@2.2.27-2	2.2.27-2+deb11u3	1
ghcr.io/conductionnl/webresourcecatalogus-nginx :latest	6de60c83128d	gnupg2@2.2.27-2+deb11u1	2.2.27-2+deb11u3	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1
ghcr.io/ctron/ditto-operator :0.4.0	61a9bb81b85c	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
ghcr.io/ctron/kubectl :1.25	e37d61b5277c	gnupg2@2.2.20-3.el8_6	0:2.2.20-4.el8_10	1
ghcr.io/ctron/streamsheets-base :2.4.0	0cf25ed621e2	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
ghcr.io/ctron/streamsheets-gateway :2.4.0	0635f17c9d2c	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	gnupg2@2.2.20-2.el8	0:2.2.20-4.el8_10	1
ghcr.io/cunningpike/fediblockhole :0.4.2	2abc5f0350dc	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/dask/dask :2024.1.0	080150de7d86	gnupg2@2.2.19-3ubuntu2.2	2.2.19-3ubuntu2.5+esm1	1
ghcr.io/dask/dask-gateway-server :2024.1.0	881e7acfc5a0	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/dask/dask-notebook :2024.1.0	f53bde3acd4f	gnupg2@2.2.27-3ubuntu2.1	2.2.27-3ubuntu2.5	1
ghcr.io/data-fair/elasticsearch :7.17.1	aa45adaf59a7	gnupg2@2.2.19-3ubuntu2.1	2.2.19-3ubuntu2.5+esm1	1
ghcr.io/dellnoantechnp/canal-server :v1.1.6	af724c855f65	gnupg2@2.2.27-2+deb11u2	2.2.27-2+deb11u3	1
ghcr.io/developmentseed/titiler :0.22.4	8ac53eb38393	gnupg2@2.2.40-1.1	2.2.40-1.1+deb12u2	1