StackRadar

CVE-2025-9086

High

Advisory

Published 10 Sept 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
570
of 17,787 indexed, latest versions
Container images
625
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: curl security update

Carried by container images the latest versions of 570 of 17,787 indexed charts deploy, on 625 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.74.0-1.3+b1, 7.74.0-1.3+deb11u1, 7.74.0-1.3+deb11u2+12 more7.74.0-1.3+deb11u16, 8.14.1-2+deb13u1, 8.14.1-2+e1, 8.14.1-2ubuntu1.1286
curlapk8.14.0-r2, 8.14.1-r0, 8.14.1-r18.14.1-r234
curlrpm7.61.1-8.el8, 7.61.1-11.el8, 7.61.1-12.el8, 7.61.1-12.el8_2.4+34 more0:7.61.1-34.el8_10.9, 0:7.76.1-23.el9_2.8, 0:7.76.1-29.el9_4.3, 0:7.76.1-31.el9_6.2+2 more305
OSV records
ALPINE-CVE-2025-9086DEBIAN-CVE-2025-9086UBUNTU-CVE-2025-9086RHSA-2025:23043RHSA-2025:23125RHSA-2025:23127RHSA-2025:23383RHSA-2026:1350RHSA-2026:1825RLSA-2025:23383RLSA-2026:1350DLA-4432-1ECHO-6a25-e091-8eb3
Also known as
USN-8062-1

Charts affected

570 by stars
ChartLatestAffected imagesRadar Score
velero-notificationsvelero-notifications1.1.01 of 1See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,285
vinyl-lib-chartvinyl-libVerified publisher0.1.01 of 1See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kporwit/vinyl_lib_app:v0.1.1217de0302218
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

3,392
resultappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repoVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,262
resultappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,262
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

2,019
mediawikiwbstack0.14.01 of 1See more

mediawiki wbstack 0.14.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/mediawiki:1.37-7.4-20220621-fp-beta-0c3012c8a34b4
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,132
drillwearefrank1.3.62 of 3See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

9,397
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9

Open the chart page →

28,605
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-nginx:latest6de60c83128d
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

7,552
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
curl@7.61.1-14.el8_3.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,915
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

6,138
wexa-studiowexa-studio1.2.03 of 15See more

wexa-studio wexa-studio 1.2.0

3 of the 15 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
curl@8.14.1-r0
8.14.1-r2
temporalio/server:1.29.1c1e3326b2ce1
curl@8.14.1-r0
8.14.1-r2
quay.io/mongodb/mongodb-kubernetes-operator:0.9.05ee4bd681085
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9

Open the chart page →

14,983
vaultwardenwitcom-gmbh0.2.01 of 2See more

vaultwarden witcom-gmbh 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
vaultwarden/server:1.25.239f34c5159a2
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,585
wp-gats-helmwordpress-gatsby0.0.11 of 3See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
library/wordpress:6.0.0-php8.0-apache277c6c25980f
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,021
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

11,577
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,016
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

1,838
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9

Open the chart page →

3,697

Container images carrying it

625 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/minio/mc:RELEASE.2023-09-29T16-41-22Za784ce6e3b1b
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
2
quay.io/minio/mc:RELEASE.2023-01-28T20-29-38Zad34abeba912
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9
2
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
2
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
curl@7.61.1-30.el8_8.2
0:7.61.1-34.el8_10.9
2
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9
2
quay.io/mongodb/mongodb-kubernetes-operator:0.13.02dcc6393e6f7
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9
2
quay.io/opencloudio/ibm-mongodb:4.0.24d8c631a6dc43
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9
2
quay.io/openshift/origin-cli:4.7464a3af4dfe0
curl@7.61.1-18.el8_4.2
0:7.61.1-34.el8_10.9
2
quay.io/openshift/origin-cli:4.8bb5e052770e5
curl@7.61.1-18.el8_4.2
0:7.61.1-34.el8_10.9
2
quay.io/strimzi/operator:0.39.002f6f143fc6d
curl@7.61.1-33.el8
0:7.61.1-34.el8_10.9
2
quay.io/strimzi/operator:0.46.0ac434a48ac2b
curl@7.76.1-31.el9
0:7.76.1-35.el9_7.3
2
quay.io/zncdatadev/tools:1.0.0-kubedoop0.0.0-dev382fca2054c9
curl@7.76.1-31.el9_6.1
0:7.76.1-31.el9_6.2
2
registry.k8s.io/ingress-nginx/controller:v1.11.8695d79381ee6
curl@8.14.1-r1
8.14.1-r2
2
abohatyrenko/bucket-backup-restore:latestfa98af15a13e
curl@7.74.0-1.3+deb11u10
7.74.0-1.3+deb11u16
1
activepieces/activepieces:0.23.0c26188b44e62
curl@7.74.0-1.3+deb11u11
7.74.0-1.3+deb11u16
1
adolfintel/speedtest:latest1f828fe83374
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
aidasi/swpspa:v1-1-net6-k8s-test-betadee4ec566312
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
akeyless/base-rhel:0.0.14ba8900a0061
curl@7.61.1-33.el8
0:7.61.1-34.el8_10.9
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
curl@8.14.1-r1
8.14.1-r2
1
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
allegroai/clearml-serving-statistics:1.3.0c58d9da7bdf8
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
alpine/k8s:1.31.106dbe6f391eda
curl@8.14.1-r0
8.14.1-r2
1
alpine/k8s:1.31.137a319b15cfc9
curl@8.14.1-r1
8.14.1-r2
1
alpine/kubectl:1.33.32c59a3f0726c
curl@8.14.1-r1
8.14.1-r2
1
alquimiaai/studio:certification38a1f0341982
curl@7.76.1-34.el9
0:7.76.1-35.el9_7.3
1
altinity/clickhouse-operator:0.19.07a85f522c5bc
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9
1
altinity/clickhouse-operator:0.20.08f0f582d41f0
curl@7.61.1-30.el8_8.2
0:7.61.1-34.el8_10.9
1
altinity/metrics-exporter:0.20.01a46d104406d
curl@7.61.1-30.el8_8.2
0:7.61.1-34.el8_10.9
1
anchore/anchore-engine:v0.10.0bde9eedf639d
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9
1
anchore/anchore-engine:v0.7.1ed9b3badd17c
curl@7.61.1-11.el8
0:7.61.1-34.el8_10.9
1
andreacioni/kube-workload-restarter:0.0.242938b310090a
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
andrianrf/backoffice:latest047a7837651e
curl@7.61.1-34.el8
0:7.61.1-34.el8_10.9
1
andrianrf/backoffice-be:latest6036614803d4
curl@7.76.1-23.el9_2.1
0:7.76.1-23.el9_2.8
1
andrianrf/iso-server:latest7da47f525c7d
curl@7.76.1-23.el9_2.1
0:7.76.1-23.el9_2.8
1
apache/camel-k:1.10.43bb13d14f64a
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9
1
apache/drill:1.21.11f96558fd292
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
apachepinot/pinot:latest-jdk110018bb04ced7
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
curl@7.76.1-34.el9
0:7.76.1-35.el9_7.3
1
apecloud/smartfs-csi-driver:0.1.1ff2858eab9cc
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9
1
apicurio/apicurio-studio-api:0.2.62.Final302d202ed149
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
apicurio/apicurio-studio-ui:0.2.62.Final349c845270c2
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
apicurio/apicurio-studio-ws:0.2.62.Final27a91978a388
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
archish27/python-fastapi-postgres:latest6610071a2101
curl@7.74.0-1.3+deb11u2
7.74.0-1.3+deb11u16
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
curl@7.74.0-1.3+deb11u11
7.74.0-1.3+deb11u16
1
aroralalit/student-producer:1.0.02a094f597b36
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
assistiot/cybersecurity-monitoring_ir-ctx:latestae8b3d72eb5d
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
assistiot/identity-manager_kc:latest0df4b4fa899a
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.