CVE-2025-70873
HighAdvisory
Published 12 Mar 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.003
- 23rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,133
- of 17,787 indexed, latest versions
- Container images
- 918
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
lemon-3.51.3-1.1 on GA media
Carried by container images the latest versions of 1,133 of 17,787 indexed charts deploy, on 918 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| sqlite3deb | 3.40.1-2, 3.40.1-2+deb12u1, 3.40.1-2+deb12u2, 3.46.1-7+4 more | 3.46.1-7+e2 | 916 |
| sqlite3rpm | 3.28.0-lp151.2.3.1 | 3.51.3-1.1 | 2 |
Charts affected
1,133 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| cap-captcha-serverf3k-techVerified publisher | 0.21.0 | 1 of 1See more | 1,676 |
| fastapi-microservice-appfast-api-microservice-app | 1.3.0 | 3 of 4See more | 9,619 |
| taigafermosit | 0.0.11 | 2 of 7See more | 8,520 |
| ferriskeyferriskey | 0.7.2 | 1 of 3See more | 3,223 |
| rss-bridgegabe565Verified publisher | 0.5.2 | 1 of 1See more | 2,193 |
| valheimgeek-cookbookVerified publisher | 4.4.2 | 1 of 1See more | 4,893 |
| gentrace-self-hostedgentrace-self-hostedVerified publisher | 0.1.3 | 1 of 9See more | 15,606 |
| openbaogitlabVerified publisher | 0.18.1 | 1 of 1See more | 1,739 |
| greenkubegreenkubeVerified publisher | 0.3.0 | 1 of 3See more | 1,816 |
| castopodh2mVerified publisher | 1.12.10 | 1 of 3See more | 10,106 |
| haproxy-redis-sentinelhaproxy-redis-sentinelVerified publisher | 0.1.3 | 1 of 2See more | 4,295 |
| harp-proxyharp | 0.8.1 | 1 of 1See more | 6,092 |
| hawkhawk | 1.1.5 | 1 of 4See more | 13,656 |
| hello-helmhellok8s | 0.1.0 | 1 of 2See more | 2,012 |
| guacamolehelmforgeVerified publisher | 1.5.2 | 2 of 5See more | 8,773 |
| matomohelmforgeVerified publisher | 2.3.0 | 1 of 3See more | 2,711 |
| valkeyhelmforgeVerified publisher | 2.0.4 | 1 of 1See more | 804 |
| vaultwardenhelmforgeVerified publisher | 1.13.1 | 1 of 1See more | 1,756 |
| mywebapphelm-nginxVerified publisher | 0.1.0 | 1 of 1See more | 1,839 |
| helmuphelmupVerified publisher | 0.1.0 | 3 of 3See more | 16,532 |
| hiverhiverVerified publisher | 0.1.45 | 8 of 10See more | 21,779 |
| refineryhoneycomb | 3.4.0 | 1 of 2See more | 978 |
| spoolmanideaplexusVerified publisher | 2.7.1 | 1 of 1See more | 1,786 |
| backendikusi-bk-chart | 1.0.3 | 3 of 3See more | 5,976 |
| odooimioVerified publisher | 3.0.2 | 1 of 3See more | 3,081 |
| immichimmich-helm | 0.3.0 | 4 of 4See more | 15,749 |
| iris-webappiris-webapp | 0.2.4 | 1 of 2See more | 11,794 |
| jellyfinjellyfinVerified publisher | 0.3.30 | 1 of 1See more | 2,571 |
| jenkinsjkimVerified publisher | 5.5.14 | 1 of 2See more | 7,393 |
| web-chartkbt-ktcloudlab | 0.1.0 | 1 of 1See more | 1,839 |
| kdiffkdiff-snapshotsVerified publisher | 0.0.203 | 1 of 2See more | 5,515 |
| kdiff-snapshotskdiff-snapshotsVerified publisher | 0.0.55 | 1 of 1See more | 5,795 |
| app-componentkeltio-helm-chartsVerified publisher | 3.14.0 | 1 of 1See more | 1,839 |
| kenerkenerVerified publisher | 0.2.0 | 1 of 1See more | 5,234 |
| kikplatekikplateVerified publisher | 0.22.0 | 1 of 3See more | 2,783 |
| glpikitsune-itopsVerified publisher | 1.0.7 | 1 of 3See more | 4,878 |
| powerdns-recursorklicktippVerified publisher | 0.4.10 | 1 of 1See more | 1,886 |
| knot-resolverknot-resolverVerified publisher | 1.0.5 | 1 of 1See more | 2,061 |
| difykubeblocksVerified publisher | 0.5.1 | 2 of 5See more | 20,424 |
| kubeseal-webguikubeseal-webgui | 6.0.4 | 1 of 2See more | 4,101 |
| kuma-ingress-watcherkuma-ingress-watcherVerified publisher | 1.4.0 | 1 of 1See more | 2,668 |
| ohifkylesferrazzaVerified publisher | 0.1.0 | 1 of 2See more | 3,524 |
| overpass-apil4gVerified publisher | 0.1.2 | 1 of 1See more | 3,551 |
| api-gatewaylabs64io-helm-chartsVerified publisher | 0.12.0 | 1 of 1See more | 1,018 |
| checkoutlabs64io-helm-chartsVerified publisher | 0.8.0 | 1 of 3See more | 1,638 |
| payment-gatewaylabs64io-helm-chartsVerified publisher | 0.8.0 | 1 of 2See more | 2,708 |
| flaresolverrlib42Verified publisher | 2.0.0 | 1 of 1See more | 35,058 |
| halitesql | 0.1.5 | 1 of 2See more | 1,111 |
| music-assistant-serverlmatfyVerified publisher | 0.1.9 | 1 of 1See more | 7,216 |
| locustlocustVerified publisher | 0.1.4 | 1 of 1See more | 2,763 |
Container images carrying it
918 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | cf8538bf6489 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 61b2eb9eed8e | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 14d45b2a1f00 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | fa35b9519abb | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 788173c5876d | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 2bc7b260e44e | sqlite3 | no fix listed | 1 |
| ghcr.io/ | dd31d4713ef6 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | a198ac7bc8c1 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 220c5e4e1a3d | sqlite3 | no fix listed | 1 |
| ghcr.io/ | e1351a977607 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 99fd4cb0f4fe | sqlite3 | no fix listed | 1 |
| ghcr.io/ | c73527cde81c | sqlite3 | no fix listed | 1 |
| ghcr.io/ | ee9cf22a39ab | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 6daa2dc7556b | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 8bf880fe8c73 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | bfadbab9a72c | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 75b7d2dcdb91 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | aa6699b027bb | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 45459c0910fc | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 50ea1cf0086f | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 6cb94aa01999 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 039ef2b811cf | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 86ab9effd1a5 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 6df27f944fe8 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 6e04659a3baa | sqlite3 | no fix listed | 1 |
| ghcr.io/ | dbaa8527bf4c | sqlite3 | no fix listed | 1 |
| ghcr.io/ | aa7d5d5dd6be | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 1b53b0b3488e | sqlite3 | no fix listed | 1 |
| ghcr.io/ | d19d886d5090 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 5a6fe78d4d15 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 2930290a758c | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 9b220ea83329 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 7bff29dcec72 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | e65123a43ecc | sqlite3 | no fix listed | 1 |
| ghcr.io/ | fbba58ddb1a6 | sqlite3 | no fix listed | 1 |
| ghcr.io/ | 7dc0ee57b628 | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | 5a5d32281374 | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | 832d7785830f | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | 59c7e728fb3a | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | b7d7910c0bb0 | sqlite3 | 3.46.1-7+e2 | 1 |
| public.ecr.aws/ | b1493760c716 | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | 5cd62142d6ed | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | 046ef5c9ed50 | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | 36d051110158 | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | 9e14a72b066d | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | f7567ce3419d | sqlite3 | no fix listed | 1 |
| public.ecr.aws/ | f74851ce31f5 | sqlite3 | no fix listed | 1 |
| quay.io/ | 9c8a510dc25e | sqlite3 | no fix listed | 1 |
| quay.io/ | a9f835d1b241 | sqlite3 | no fix listed | 1 |
| quay.io/ | 2c324c9789f5 | sqlite3 | no fix listed | 1 |