CVE-2025-69421

High

Advisory

Published 27 Jan 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.009; 58th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,262; of 17,813 indexed, latest versions
Container images: 2,524; deployed by those charts
Fix available: 4 of 5; affected packages

CVE-2025-69421 affecting package openssl for versions less than 3.3.5-3

Carried by container images the latest versions of 2,262 of 17,813 indexed charts deploy, on 2,524 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	1.0.1f-1ubuntu2.5, 1.0.1f-1ubuntu2.8, 1.0.1f-1ubuntu2.25, 1.0.1f-1ubuntu2.27+93 more	1.0.1f-1ubuntu2.27+esm12, 1.0.2g-1ubuntu4.20+esm14, 1.1.1-1ubuntu2.1~18.04.23+esm7, 1.1.1f-1ubuntu2.24+esm2+5 more	1,575
opensslapk	3.0.7-r0, 3.0.7-r2, 3.0.8-r0, 3.0.8-r1+34 more	3.0.19-r0, 3.3.6-r0, 3.5.5-r0, 3.6.1-r0	948
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+13 more	no fix listed	22
openssl1.0deb	1.0.2n-1ubuntu5.3, 1.0.2n-1ubuntu5.4, 1.0.2n-1ubuntu5.6, 1.0.2n-1ubuntu5.7+4 more	1.0.2n-1ubuntu5.13+esm3	20
opensslrpm	3.3.5-1.azl3	3.3.5-3	1

OSV records: ALPINE-CVE-2025-69421 CGA-f52p-r4fw-2gg9 DEBIAN-CVE-2025-69421 UBUNTU-CVE-2025-69421 AZL-75287
Also known as: CGA-ggqp-v682-3mmx, USN-7980-1, USN-7980-2

Charts affected

2,262 by stars

Chart

Latest

Affected images

Radar Score

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	openssl@3.3.4-r0	3.3.6-r0

Open the chart page →

1,197

dingtalk-botxxl-job-admin

0.1.2

1 of 2 See more

dingtalk-bot xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
dellnoantechnp/dingtalk-bot :v1.0.1	034000bbcad5	openssl@3.5.4-1~deb13u1	3.5.4-1~deb13u2

Open the chart page →

3,185

nightingalexxl-job-admin

0.2.11

1 of 6 See more

nightingale xxl-job-admin 0.2.11

1 of the 6 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	openssl@3.0.16-1~deb12u1	3.0.18-1~deb12u2

Open the chart page →

9,738

pgcatxxl-job-admin

0.3.3

1 of 1 See more

pgcat xxl-job-admin 0.3.3

1 of the 1 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	openssl@3.0.13-1~deb12u1	3.0.18-1~deb12u2

Open the chart page →

3,196

yearningxxl-job-admin

0.2.3

1 of 1 See more

yearning xxl-job-admin 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
yeelabs/yearning :v3.1.8	1576c002d1df	openssl@3.0.8-r3	3.0.19-r0

Open the chart page →

641

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	openssl@3.3.2-r0	3.3.6-r0

Open the chart page →

9,526

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2

Open the chart page →

2,718

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	openssl@3.0.9-r1	3.0.19-r0
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	openssl@3.0.9-r1	3.0.19-r0

Open the chart page →

5,077

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	openssl@1.1.1-1ubuntu2.1~18.04.23	1.1.1-1ubuntu2.1~18.04.23+esm7

Open the chart page →

2,485

zahori-serverzahori

1.0.1

2 of 2 See more

zahori-server zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	openssl@3.0.7-r2	3.0.19-r0
zahoriaut/zahori-server :0.1.17	b2de13916f3e	openssl@3.0.8-r3	3.0.19-r0

Open the chart page →

5,846

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	openssl@1.1.1-1ubuntu2.1~18.04.14	1.1.1-1ubuntu2.1~18.04.23+esm7
yandex/clickhouse-server :21.3.20	4eccfffb01d7	openssl@1.1.1f-1ubuntu2.10	1.1.1f-1ubuntu2.24+esm2

Open the chart page →

9,296

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-69421.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	openssl@3.0.2-0ubuntu1.26	no fix listed

Open the chart page →

7,966

Container images carrying it

2,524 by charts deploying them

A fixed version is listed for 4 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	openssl@3.0.18-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/wiremind/bitnami/rabbitmq :4.2.2-debian-12-r1	1572e12bc93c	openssl@3.0.18-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/wiremind/bitnami/redis :8.4.0-debian-12-r3	1f0f7ddc4370	openssl@3.0.18-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2	1
ghcr.io/wjentner/k8s-db-backup-retention :v1.1.0	8027bb46d1f4	openssl@3.3.2-r4	3.3.6-r0	1
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	openssl@1.1.1-1ubuntu2.1~18.04.17	1.1.1-1ubuntu2.1~18.04.23+esm7	1
ghcr.io/wolveix/satisfactory-server :v1.9.10	e0f2f8c97598	openssl@3.0.2-0ubuntu1.19	3.0.2-0ubuntu1.21	1
ghcr.io/woodenmaiden/relfinderreformedapi :1.1.2	0708d30433d4	openssl@3.3.1-r0	3.3.6-r0	1
ghcr.io/woodenmaiden/relfinderreformedfront :latest	344f53763b25	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2	1
ghcr.io/wundergraph/cosmo/controlplane :0.133.1	49800ff775f3	openssl@3.3.3-r0	3.3.6-r0	1
ghcr.io/wundergraph/cosmo/graphqlmetrics :0.33.0	efb69ec3330c	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/wundergraph/cosmo/router :0.243.0	5afcab98d9d7	openssl@3.0.17-1~deb12u2	3.0.18-1~deb12u2	1
ghcr.io/wundergraph/cosmo/studio :0.111.0	454f4384713a	openssl@3.3.3-r0	3.3.6-r0	1
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	openssl@3.3.2-r0	3.3.6-r0	1
ghcr.io/zalando/postgres-operator :v1.14.0	4f40cfc2283b	openssl@3.3.2-r4	3.3.6-r0	1
ghcr.io/zalando/postgres-operator :v1.12.2	d81cda253f5c	openssl@3.3.0-r2	3.3.6-r0	1
ghcr.io/zazukoians/qlever-ui :v0.10.1	51a7ec1c2de4	openssl@3.3.1-r3	3.3.6-r0	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/zoriya/kyoo_back :4.7.1	416e980f76a6	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/zoriya/kyoo_front :4.7.1	d7f76c9c65d9	openssl@3.3.2-r4	3.3.6-r0	1
ghcr.io/zoriya/kyoo_migrations :4.7.1	f7e607f24071	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
ghcr.io/zystem-io/zymtrace-pub-gateway :26.9.2	ae9ae0925ff8	openssl@3.0.2-0ubuntu1.20	3.0.2-0ubuntu1.21	1
ghcr.io/zystem-io/zymtrace-pub-ui :26.9.2	9a32b89c0c19	openssl@3.5.0-r0	3.5.5-r0	1
mcr.microsoft.com/azure-application-gateway/kubernetes-ingress :1.6.0	bccaa701e2df	openssl@1.1.1f-1ubuntu2.16	1.1.1f-1ubuntu2.24+esm2	1
mcr.microsoft.com/mssql/server :2017-latest	13221ac5f673	openssl@1.1.1-1ubuntu2.1~18.04.23 openssl1.0@1.0.2n-1ubuntu5.13	1.1.1-1ubuntu2.1~18.04.23+esm7 1.0.2n-1ubuntu5.13+esm3	1
mcr.microsoft.com/mssql/server :2022-latest	4402d880dd4c	openssl@3.0.2-0ubuntu1.29	no fix listed	1
mcr.microsoft.com/mssql/server :2019-CU16-ubuntu-20.04	49a57dc220b1	openssl@1.1.1f-1ubuntu2.12	1.1.1f-1ubuntu2.24+esm2	1
mcr.microsoft.com/mssql/server :2017-latest	fbf79e0fea59	openssl@1.1.1-1ubuntu2.1~18.04.23 openssl1.0@1.0.2n-1ubuntu5.13	1.1.1-1ubuntu2.1~18.04.23+esm7 1.0.2n-1ubuntu5.13+esm3	1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-provisioner :v5.2.0	afdfa3da79df	openssl@3.3.5-1.azl3	3.3.5-3	1
mcr.microsoft.com/playwright/mcp :v0.0.43	e101b832b34d	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2	1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.74.4_local	1ed844ecab29	openssl@3.0.13-0ubuntu3.6	3.0.13-0ubuntu3.7	1
public.ecr.aws/aktosecurity/keelhq-keel :akto_v1.0.0	1eb61443d68e	openssl@3.3.2-r0	3.3.6-r0	1
public.ecr.aws/aktosecurity/redis	47200b041382	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2	1
public.ecr.aws/buildkite/agent-metrics :v5.11.0	16e7f5c7161e	openssl@3.5.1-r0	3.5.5-r0	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	openssl@3.0.13-0ubuntu3.6	3.0.13-0ubuntu3.7	1
public.ecr.aws/decisiveai/valkey :9.0.1	59c7e728fb3a	openssl@3.5.4-1~deb13u1	3.5.4-1~deb13u2	1
public.ecr.aws/g4a0y2u8/unifie-store :staging-19925	a2057fabc948	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	openssl@3.0.2-0ubuntu1.19	3.0.2-0ubuntu1.21	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	openssl@3.0.14-1~deb12u2	3.0.18-1~deb12u2	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	openssl@3.0.14-1~deb12u2	3.0.18-1~deb12u2	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	openssl@3.0.11-1~deb12u2	3.0.18-1~deb12u2	1
public.ecr.aws/k4y9r6y5/kratos :v25.4.0	e8014c6c58b6	openssl@3.3.5-r0	3.3.6-r0	1
public.ecr.aws/k6v9y5g3/cluster-agent :master.575	36d051110158	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
public.ecr.aws/k6v9y5g3/cluster-agent :cost_k8s_process.576	9e14a72b066d	openssl@3.0.15-1~deb12u1	3.0.18-1~deb12u2	1
public.ecr.aws/lumigo/lumigo-kubernetes-operator :69	491c39346b19	openssl@3.5.1-r0	3.5.5-r0	1