CVE-2025-69420

High

Advisory

Published 27 Jan 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 56th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,209; of 17,821 indexed, latest versions
Container images: 2,466; deployed by those charts
Fix available: 3 of 4; affected packages

CVE-2025-69420 affecting package openssl for versions less than 3.3.5-3

Carried by container images the latest versions of 2,209 of 17,821 indexed charts deploy, on 2,466 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	1.1.0g-2ubuntu4.1, 1.1.0g-2ubuntu4.3, 1.1.1-1ubuntu2.1~18.04.4, 1.1.1-1ubuntu2.1~18.04.5+76 more	1.1.1-1ubuntu2.1~18.04.23+esm7, 1.1.1f-1ubuntu2.24+esm2, 3.0.2-0ubuntu1.21, 3.0.13-0ubuntu3.7+3 more	1,509
opensslapk	3.0.7-r0, 3.0.7-r2, 3.0.8-r0, 3.0.8-r1+34 more	3.0.19-r0, 3.3.6-r0, 3.5.5-r0, 3.6.1-r0	951
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+13 more	no fix listed	22
opensslrpm	3.3.5-1.azl3	3.3.5-3	1

OSV records: ALPINE-CVE-2025-69420 CGA-8h52-q2fx-gx4p DEBIAN-CVE-2025-69420 UBUNTU-CVE-2025-69420 AZL-75269
Also known as: CGA-p8fj-r6mr-jjjj, USN-7980-1, USN-7980-2

Charts affected

2,209 by stars

Chart

Latest

Affected images

Radar Score

pgcatxxl-job-admin

0.3.3

1 of 1 See more

pgcat xxl-job-admin 0.3.3

1 of the 1 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	openssl@3.0.13-1~deb12u1	3.0.18-1~deb12u2

Open the chart page →

3,197

yearningxxl-job-admin

0.2.3

1 of 1 See more

yearning xxl-job-admin 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
yeelabs/yearning :v3.1.8	1576c002d1df	openssl@3.0.8-r3	3.0.19-r0

Open the chart page →

641

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	openssl@3.3.2-r0	3.3.6-r0

Open the chart page →

9,528

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2

Open the chart page →

2,638

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	openssl@3.0.9-r1	3.0.19-r0
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	openssl@3.0.9-r1	3.0.19-r0

Open the chart page →

5,077

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	openssl@1.1.1-1ubuntu2.1~18.04.23	1.1.1-1ubuntu2.1~18.04.23+esm7

Open the chart page →

2,485

zahori-serverzahori

1.0.1

2 of 2 See more

zahori-server zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	openssl@3.0.7-r2	3.0.19-r0
zahoriaut/zahori-server :0.1.17	b2de13916f3e	openssl@3.0.8-r3	3.0.19-r0

Open the chart page →

5,847

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	openssl@1.1.1-1ubuntu2.1~18.04.14	1.1.1-1ubuntu2.1~18.04.23+esm7
yandex/clickhouse-server :21.3.20	4eccfffb01d7	openssl@1.1.1f-1ubuntu2.10	1.1.1f-1ubuntu2.24+esm2

Open the chart page →

9,297

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-69420.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	openssl@3.0.2-0ubuntu1.26	no fix listed

Open the chart page →

7,966

Container images carrying it

2,466 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.gitlab.com/dyff/dyff-frontend :0.20.2	481be0beaafe	openssl@3.3.3-r0	3.3.6-r0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/rabbitmq :3.12.14	5a9334f371f3	openssl@3.0.13-1~deb12u1	3.0.18-1~deb12u2	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	openssl@1.1.1f-1ubuntu2.2	1.1.1f-1ubuntu2.24+esm2	1
registry.k8s.io/dns/k8s-dns-node-cache :1.23.0	81a13703d6b8	openssl@3.0.11-1~deb12u1	3.0.18-1~deb12u2	1
registry.k8s.io/dns/k8s-dns-node-cache :1.26.7	8b9a78d101a1	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2	1
registry.k8s.io/dns/k8s-dns-node-cache :1.23.1	e3dccb1a21d1	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2	1
registry.k8s.io/git-sync/git-sync :v4.5.0	0e64aedb0d0a	openssl@3.5.1-1	3.5.4-1~deb13u2	1
registry.k8s.io/git-sync/git-sync :v4.1.0	fd9722fd02e3	openssl@3.0.11-1~deb12u1	3.0.18-1~deb12u2	1
registry.k8s.io/ingress-nginx/controller :v1.6.4	15be4666c530	openssl@3.0.8-r0	3.0.19-r0	1
registry.k8s.io/ingress-nginx/controller :v1.13.2	1f7eaeb01933	openssl@3.5.2-r0	3.5.5-r0	1
registry.k8s.io/ingress-nginx/controller :v1.13.1	37e489b22ac7	openssl@3.5.1-r0	3.5.5-r0	1
registry.k8s.io/ingress-nginx/controller :v1.7.0	7612338342a1	openssl@3.0.8-r1	3.0.19-r0	1
registry.k8s.io/ingress-nginx/controller :v1.11.3	d56f135b6462	openssl@3.3.2-r0	3.3.6-r0	1
registry.k8s.io/ingress-nginx/controller :v1.12.0	e6b8de175acd	openssl@3.3.2-r4	3.3.6-r0	1
registry.k8s.io/provider-os/manila-csi-plugin :v1.36.0	190976e2e2fe	openssl@3.5.4-r0	3.5.5-r0	1
registry.k8s.io/sig-storage/nfsplugin :v4.11.0	ce5b5ccd5eb0	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1