CVE-2025-71330
HighAdvisory
Published 10 Jun 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.004
- 36th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 47
- of 17,781 indexed, latest versions
- Container images
- 44
- deployed by those charts
- Fix available
- None
- affected package
image-size: ICNS parser allows denial of service through an infinite loop
Carried by container images the latest versions of 47 of 17,781 indexed charts deploy, on 44 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| image-sizenpm | 0.4.0, 0.5.5, 0.6.3, 0.7.5+10 more | no fix listed | 44 |
- OSV records
- GHSA-w3rx-r6r6-pgpr
Charts affected
47 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| difydify-helmVerified publisher | 0.38.0 | 1 of 11See more | 22,002 |
| wikijsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 5,946 |
| ghostcloudpirates-ghostVerified publisher | 0.20.22 | 1 of 3See more | 7,146 |
| codetogethercodetogether | 1.4.25 | 1 of 1See more | 7,450 |
| rsshubgabe565Verified publisher | 0.8.0 | 1 of 3See more | 1,717 |
| ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher | 1.1.2 | 1 of 3See more | 1,447 |
| kongakonga | 1.1.0 | 1 of 1See more | 5,209 |
| joplin-serverdjjudas21Verified publisher | 5.5.8 | 1 of 1See more | 3,925 |
| ghostgeek-cookbookVerified publisher | 2.2.0 | 1 of 1See more | 4,260 |
| overseerrgeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 3,444 |
| ghostgroundhog2k | 0.212.12 | 1 of 1See more | 2,000 |
| food-managermoreillonVerified publisher | 0.5.0 | 1 of 2See more | 13,738 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 31,844 |
| jellyseerrrtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 1See more | 2,823 |
| wikiwenerme | 2.2.0 | 1 of 2See more | 3,833 |
| openhab-cloudandibraeuVerified publisher | 1.2.6 | 1 of 1See more | 3,437 |
| angular-chartangular-application | 0.1.0 | 1 of 1See more | 3,237 |
| openapiassist-iot-open-api-management | 0.2.2 | 1 of 6See more | 18,277 |
| nas-appsawesomeVerified publisher | 2.0.0 | 1 of 8See more | 7,152 |
| ghostchart-ghost | 0.1.5 | 1 of 2See more | 4,083 |
| quickchartcowboysysopVerified publisher | 5.0.0 | 1 of 1See more | 5,488 |
| kongacreate-databases | 0.1.0 | 1 of 1See more | 5,209 |
| desishowbiz-frontenddesishowbiz | 1.0.0 | 1 of 1See more | 2,529 |
| ghostghostVerified publisher | 0.1.0 | 1 of 4See more | 9,019 |
| ghosthelmforgeVerified publisher | 1.2.6 | 1 of 3See more | 2,463 |
| paprahelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 2,538 |
| wikijshomeenterpriseinc | 1.4.0 | 1 of 1See more | 4,253 |
| nocodbinseefrlab | 0.2.0 | 1 of 1See more | 781 |
| ghostjanip81-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 3,436 |
| yapijoelee2012Verified publisher | 0.2.0 | 1 of 1See more | 6,454 |
| ghostk8s-home-lab-repo | 4.1.0 | 1 of 1See more | 3,092 |
| ghostkubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 2,756 |
| seerrkubernetes-homelab-helm-chartsVerified publisher | 0.1.2 | 1 of 1See more | 2,548 |
| jellyseerrlbenicio-communityVerified publisher | 0.1.0 | 1 of 1See more | 3,555 |
| squareonelsst-sqre | 0.4.1 | 1 of 1See more | 2,247 |
| mauticmautic-chartVerified publisher | 1.0.2 | 1 of 3See more | 8,303 |
| tianjimsgbyte | 0.1.17 | 1 of 2See more | 4,560 |
| ghostmt190502 | 8.25.1 | 1 of 3See more | 4,960 |
| example-dev-toolsnoygal | 0.2.8 | 2 of 3See more | 27,465 |
| codimdphntom | 0.1.12 | 1 of 3See more | 6,524 |
| etherpadredhat-cop | 0.0.8 | 1 of 1See more | 895 |
| gristrlex | 0.1.0 | 1 of 1See more | 5,215 |
| joplinrubxkubeVerified publisher | 1.3.1 | 1 of 2See more | 7,413 |
| rsshubsb-helm-charts | 0.3.0 | 1 of 1See more | 4,684 |
| csmmth-chartsVerified publisher | 0.1.0 | 1 of 3See more | 3,576 |
| joplintobiassackmann | 0.1.7 | 1 of 2See more | 5,535 |
| wikiwikijs | 3.0.0 | 1 of 2See more | 5,459 |
Container images carrying it
44 by charts deploying them
A fixed version is listed for 0 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| pantsel/ | c8172b75607d | image-size | no fix listed | 3 |
| library/ | e05bc1169fb2 | image-size | no fix listed | 2 |
| requarks/ | 68f0d1848261 | image-size | no fix listed | 2 |
| catalysm/ | f003b35f54d9 | image-size | no fix listed | 1 |
| codetogether/ | 4348c8a38752 | image-size | no fix listed | 1 |
| diygod/ | 1d4b508b6357 | image-size | no fix listed | 1 |
| diygod/ | 7a6312cac0d5 | image-size | no fix listed | 1 |
| etherpad/ | 6020e7b57f4b | image-size | no fix listed | 1 |
| fallenbagel/ | 4538137bc5af | image-size | no fix listed | 1 |
| gristlabs/ | 6e71b1914a7e | image-size | no fix listed | 1 |
| ianw/ | dc49dd460c37 | image-size | no fix listed | 1 |
| ibarreche/ | c8970ac1c8dc | image-size | no fix listed | 1 |
| jayfong/ | 163e5d621910 | image-size | no fix listed | 1 |
| joplin/ | 3f7b852959aa | image-size | no fix listed | 1 |
| joplin/ | 52af57880c0e | image-size | no fix listed | 1 |
| joplin/ | b87564ef34e9 | image-size | no fix listed | 1 |
| langgenius/ | 87dd47e4e28f | image-size | no fix listed | 1 |
| library/ | 1ef2e532ca4d | image-size | no fix listed | 1 |
| library/ | 2654b1e90413 | image-size | no fix listed | 1 |
| library/ | 29773d6be407 | image-size | no fix listed | 1 |
| library/ | 767230c0f263 | image-size | no fix listed | 1 |
| library/ | 77196da4b0df | image-size | no fix listed | 1 |
| library/ | 83f7bf209844 | image-size | no fix listed | 1 |
| library/ | a7a268bbfb7f | image-size | no fix listed | 1 |
| library/ | ac533a6988ee | image-size | no fix listed | 1 |
| linuxserver/ | 45c5fe102ff3 | image-size | no fix listed | 1 |
| linuxserver/ | b801bbcf6386 | image-size | no fix listed | 1 |
| lsstsqre/ | 9ded78e7fe03 | image-size | no fix listed | 1 |
| ltdstudio/ | 0e76c6f4eac0 | image-size | no fix listed | 1 |
| mautic/ | eb8cc73d97e1 | image-size | no fix listed | 1 |
| moonrailgun/ | b528c8f8fcc4 | image-size | no fix listed | 1 |
| moreillon/ | e8fd856e593d | image-size | no fix listed | 1 |
| nocodb/ | 4b760f0d2547 | image-size | no fix listed | 1 |
| openhab/ | 29dd2bac8c4b | image-size | no fix listed | 1 |
| phntom/ | 1b9aafbb62e6 | image-size | no fix listed | 1 |
| rahulbhiwagade122/ | 08490b70998c | image-size | no fix listed | 1 |
| requarks/ | 8b5865a7386c | image-size | no fix listed | 1 |
| treskon/ | e7970783bc8d | image-size | no fix listed | 1 |
| ghcr.io/ | 2a611369ad1d | image-size | no fix listed | 1 |
| ghcr.io/ | 58d377933678 | image-size | no fix listed | 1 |
| ghcr.io/ | a281cb44176d | image-size | no fix listed | 1 |
| ghcr.io/ | 254d16af8f71 | image-size | no fix listed | 1 |
| ghcr.io/ | c4cbd5121236 | image-size | no fix listed | 1 |
| ghcr.io/ | dd991bafa85e | image-size | no fix listed | 1 |