StackRadar

CVE-2025-9086

High

Advisory

Published 10 Sept 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
579
of 17,787 indexed, latest versions
Container images
632
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: curl security update

Carried by container images the latest versions of 579 of 17,787 indexed charts deploy, on 632 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.74.0-1.3+b1, 7.74.0-1.3+deb11u1, 7.74.0-1.3+deb11u2+12 more7.74.0-1.3+deb11u16, 8.14.1-2+deb13u1, 8.14.1-2+e1, 8.14.1-2ubuntu1.1291
curlapk8.14.0-r2, 8.14.1-r0, 8.14.1-r18.14.1-r235
curlrpm7.61.1-8.el8, 7.61.1-11.el8, 7.61.1-12.el8, 7.61.1-12.el8_2.4+34 more0:7.61.1-34.el8_10.9, 0:7.76.1-23.el9_2.8, 0:7.76.1-29.el9_4.3, 0:7.76.1-31.el9_6.2+2 more306
OSV records
ALPINE-CVE-2025-9086DEBIAN-CVE-2025-9086UBUNTU-CVE-2025-9086RHSA-2025:23043RHSA-2025:23125RHSA-2025:23127RHSA-2025:23383RHSA-2026:1350RHSA-2026:1825RLSA-2025:23383RLSA-2026:1350DLA-4432-1ECHO-6a25-e091-8eb3
Also known as
USN-8062-1

Charts affected

579 by stars
ChartLatestAffected imagesRadar Score
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
erenozcan17/react_frontend:v4.56e1b14973f9b
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

6,973
token-servertoken-server1.0.91 of 1See more

token-server token-server 1.0.9

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
udhos/token-server:1.0.9728013f2fac1
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

1,245
hermestoukVerified publisher0.6.01 of 3See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9

Open the chart page →

12,455
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

3,164
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9

Open the chart page →

1,733
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,607
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9

Open the chart page →

4,960
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
vcnngr/pnfrontend:latest4e4979ab8c41
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

4,768
velero-notificationsvelero-notifications1.1.01 of 1See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,285
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

vinyl-lib-chartvinyl-libVerified publisher0.1.01 of 1See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kporwit/vinyl_lib_app:v0.1.1217de0302218
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

3,392
resultappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repoVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,262
resultappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,262
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

2,019
mediawikiwbstack0.14.01 of 1See more

mediawiki wbstack 0.14.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/mediawiki:1.37-7.4-20220621-fp-beta-0c3012c8a34b4
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,132
drillwearefrank1.3.62 of 3See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

9,397
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9

Open the chart page →

28,605
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-nginx:latest6de60c83128d
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

7,552
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
curl@7.61.1-14.el8_3.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,915
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

6,138
wexa-studiowexa-studio1.2.03 of 15See more

wexa-studio wexa-studio 1.2.0

3 of the 15 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
curl@8.14.1-r0
8.14.1-r2
temporalio/server:1.29.1c1e3326b2ce1
curl@8.14.1-r0
8.14.1-r2
quay.io/mongodb/mongodb-kubernetes-operator:0.9.05ee4bd681085
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9

Open the chart page →

14,983
vaultwardenwitcom-gmbh0.2.01 of 2See more

vaultwarden witcom-gmbh 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
vaultwarden/server:1.25.239f34c5159a2
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,585
wp-gats-helmwordpress-gatsby0.0.11 of 3See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
library/wordpress:6.0.0-php8.0-apache277c6c25980f
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,021
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

11,577
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,016
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

1,838
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9

Open the chart page →

3,697

Container images carrying it

632 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
gurolakman/smsf-momt:1.0.4ce23b20a8a17
curl@7.61.1-33.el8
0:7.61.1-34.el8_10.9
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
curl@7.61.1-33.el8
0:7.61.1-34.el8_10.9
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
curl@7.61.1-33.el8
0:7.61.1-34.el8_10.9
1
gurolakman/ussigw-core:1.0.48739565c3ea2
curl@7.61.1-33.el8
0:7.61.1-34.el8_10.9
1
ha33ona/python:test6affdfc644d0
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
hammerspaceinc/csi-plugin:v1.2.8-rc2395bee4504fc
curl@7.76.1-31.el9_6.1
0:7.76.1-35.el9_7.3
1
hazelcast/management-center:5.3.2f9d34300d330
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
healthchecks/healthchecks:v2.8.1e82bb0836e30
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
helga09/php_shoes_ukr:v1.1.1e283539bcb8c
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
hiboxsystems/marge-bot:0.11.07235809b43b3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
hiboxsystems/marge-bot:0.12.1a96c10b61a59
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
hiboxsystems/marge-bot:0.16.0b59f01bc0418
curl@8.14.1-2
8.14.1-2+deb13u1
1
hivemq/hivemq4:dns-4.5.144d194450d48e
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
hotavneesh/eclipse-jdtls:latesta4579b163414
curl@7.74.0-1.3+deb11u13
7.74.0-1.3+deb11u16
1
hugohg34/server:0.0.2503e5d8960ff
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
hyperledgerk8s/fabric-operator:7776e7129a8af8be270
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9
1
hyperledgerk8s/minio-mc:RELEASE.2023-01-28T20-29-38Z729b3d128487
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9
1
hyperledgerk8s/minio-minio:RELEASE.2023-02-10T18-48-39Zed0b0c56f1ea
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9
1
ibmcom/ibmcloud-object-storage-driver:1.8.16c796a4c693b4
curl@7.61.1-12.el8
0:7.61.1-34.el8_10.9
1
ibmcom/ibmcloud-object-storage-plugin:1.8.169c73804b37a3
curl@7.61.1-12.el8
0:7.61.1-34.el8_10.9
1
ibmcom/ibm-enterprise-mongodb-ppc64le:4.4d28bf361327a
curl@7.61.1-14.el8_3.1
0:7.61.1-34.el8_10.9
1
ibmcom/opencontent-common-utils:1.1.2cd5065df7304
curl@7.61.1-8.el8
0:7.61.1-34.el8_10.9
1
ixsystems/truecommand:3.2.019c218455cd2
curl@8.14.1-2
8.14.1-2+deb13u1
1
j0113/haven-compliancy-dashboard:1.3696cb8ca9f4e
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
jeboehm/mailserver-web:5.0.929da13edf5aa8
curl@8.14.1-r1
8.14.1-r2
1
jellyfin/jellyfin:10.8.1305a9734d7e83
curl@7.74.0-1.3+deb11u10
7.74.0-1.3+deb11u16
1
jellyfin/jellyfin:10.8.1ee24f4459a40
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
juicedata/juicefs-csi-driver:v0.23.0d915e899e322
curl@7.74.0-1.3+deb11u10
7.74.0-1.3+deb11u16
1
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
kobotoolbox/kobocat:2.022.24ab15679454415
curl@7.74.0-1.3+deb11u2
7.74.0-1.3+deb11u16
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
curl@7.74.0-1.3+deb11u2
7.74.0-1.3+deb11u16
1
kporwit/vinyl_lib_app:v0.1.1217de0302218
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
kubebb/hello-world:0.1.0b746824819f3
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
kubeflow/model-registry:v0.2.95783f6db428f
curl@7.61.1-34.el8_10.2
0:7.61.1-34.el8_10.9
1
kubegems/bitnami-shell:12-debian-12-r24e42e3aaacdd3
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
kubegems/chatgpt-api:latestf3c492a938ad
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
kuberay/operator:v1.0.04e6ac8a3a2c4
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
library/httpd:2.4.54ee2117e77c35
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
library/logstash:9.1.233eae14f0867
curl@7.76.1-31.el9_6.1
0:7.76.1-31.el9_6.2
1
library/monica:3.7.0-apacheceb1ba4196ab
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
library/nginx:1.23.03536d368b898
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
library/nginx:1.23.2ab589a3c466e
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
library/nginx:1.23.3f4e3b6489888
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
library/nginx:1.23f5747a42e3ad
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
library/php:7.3-apacheb9872cd287ef
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
library/python:3.9da5aee29682d
curl@8.14.1-2
8.14.1-2+deb13u1
1
library/python:3.12.9-bullseyeed4450bab88f
curl@7.74.0-1.3+deb11u14
7.74.0-1.3+deb11u16
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.