StackRadar

CVE-2025-9086

High

Advisory

Published 10 Sept 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
579
of 17,787 indexed, latest versions
Container images
632
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: curl security update

Carried by container images the latest versions of 579 of 17,787 indexed charts deploy, on 632 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.74.0-1.3+b1, 7.74.0-1.3+deb11u1, 7.74.0-1.3+deb11u2+12 more7.74.0-1.3+deb11u16, 8.14.1-2+deb13u1, 8.14.1-2+e1, 8.14.1-2ubuntu1.1291
curlapk8.14.0-r2, 8.14.1-r0, 8.14.1-r18.14.1-r235
curlrpm7.61.1-8.el8, 7.61.1-11.el8, 7.61.1-12.el8, 7.61.1-12.el8_2.4+34 more0:7.61.1-34.el8_10.9, 0:7.76.1-23.el9_2.8, 0:7.76.1-29.el9_4.3, 0:7.76.1-31.el9_6.2+2 more306
OSV records
ALPINE-CVE-2025-9086DEBIAN-CVE-2025-9086UBUNTU-CVE-2025-9086RHSA-2025:23043RHSA-2025:23125RHSA-2025:23127RHSA-2025:23383RHSA-2026:1350RHSA-2026:1825RLSA-2025:23383RLSA-2026:1350DLA-4432-1ECHO-6a25-e091-8eb3
Also known as
USN-8062-1

Charts affected

579 by stars
ChartLatestAffected imagesRadar Score
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
erenozcan17/react_frontend:v4.56e1b14973f9b
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

6,974
token-servertoken-server1.0.91 of 1See more

token-server token-server 1.0.9

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
udhos/token-server:1.0.9728013f2fac1
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

1,245
hermestoukVerified publisher0.6.01 of 3See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9

Open the chart page →

12,454
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

3,164
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9

Open the chart page →

1,733
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,370
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9

Open the chart page →

4,960
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
vcnngr/pnfrontend:latest4e4979ab8c41
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

4,769
velero-notificationsvelero-notifications1.1.01 of 1See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,285
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

6,470
vinyl-lib-chartvinyl-libVerified publisher0.1.01 of 1See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kporwit/vinyl_lib_app:v0.1.1217de0302218
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

3,392
resultappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repoVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,287
resultappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,287
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

2,019
mediawikiwbstack0.14.01 of 1See more

mediawiki wbstack 0.14.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/mediawiki:1.37-7.4-20220621-fp-beta-0c3012c8a34b4
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,132
drillwearefrank1.3.62 of 3See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

9,399
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9

Open the chart page →

28,699
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-nginx:latest6de60c83128d
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

7,552
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
curl@7.61.1-14.el8_3.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,915
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

6,138
wexa-studiowexa-studio1.2.03 of 15See more

wexa-studio wexa-studio 1.2.0

3 of the 15 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
curl@8.14.1-r0
8.14.1-r2
temporalio/server:1.29.1c1e3326b2ce1
curl@8.14.1-r0
8.14.1-r2
quay.io/mongodb/mongodb-kubernetes-operator:0.9.05ee4bd681085
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9

Open the chart page →

14,618
vaultwardenwitcom-gmbh0.2.01 of 2See more

vaultwarden witcom-gmbh 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
vaultwarden/server:1.25.239f34c5159a2
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,585
wp-gats-helmwordpress-gatsby0.0.11 of 3See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
library/wordpress:6.0.0-php8.0-apache277c6c25980f
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,021
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

11,592
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,016
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

1,838
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9

Open the chart page →

3,697

Container images carrying it

632 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
library/solr:8.7.0d124efd81fbb
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
library/telegraf:1.20.428e98eece020
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
library/wordpress:6.0.0-php8.0-apache277c6c25980f
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
lmscommunity/logitechmediaserver:8.5.27434f3a6c9cb
curl@7.74.0-1.3+deb11u11
7.74.0-1.3+deb11u16
1
lnbitsdocker/lnbits-legend:latest26fae6327477
curl@7.74.0-1.3+deb11u10
7.74.0-1.3+deb11u16
1
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
lsstsqre/exposurelog:0.8.079b00fb67a65
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
lsstsqre/narrativelog:0.1.0ce01de04ce21
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
lsstsqre/strimzi-registry-operator:0.4.1e139fde946d7
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
macropower/twitch_predictions_recorder:v0.21e9c4fb89787
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
mailserver/docker-mailserver:11.0.0e0809756dc96
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
maissacrement/pock8snodejs:0.0.16da0db1159da
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
manojchaulagain/go-k8s:0.1.0f237b5f637ae
curl@7.74.0-1.3+deb11u5
7.74.0-1.3+deb11u16
1
mariadb/maxscale:23.02.256c5e0908148
curl@7.61.1-30.el8_8.2
0:7.61.1-34.el8_10.9
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
matrixdotorg/synapse:v1.78.0def97fd537d8
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
mautic/mautic:v4-apache94ea4acf4049
curl@7.74.0-1.3+deb11u14
7.74.0-1.3+deb11u16
1
mezmohq/vector:1.17.3ad5794b112af
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
michaelepitech/sample-app:latestaf51d61c19f5
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
mide/minecraft-overviewer:latest4eee0dcb715f
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
minio/kes:v0.22.255f3aef5803e
curl@7.61.1-25.el8
0:7.61.1-34.el8_10.9
1
minio/mc:RELEASE.2021-02-14T04-28-06Z2a374c124d44
curl@7.61.1-14.el8_3.1
0:7.61.1-34.el8_10.9
1
minio/mc:RELEASE.2022-05-09T04-08-26Z4b415310d8d0
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9
1
minio/mc:RELEASE.2023-02-28T00-12-59Zc631532a394e
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9
1
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9
1
minio/minio:RELEASE.2023-03-20T20-16-18Z6d770d7f255c
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9
1
minio/minio:RELEASE.2022-10-24T18-35-07Zf9576903f19d
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9
1
minio/minio:RELEASE.2023-01-12T02-06-16Zfc6bedc99355
curl@7.61.1-25.el8
0:7.61.1-34.el8_10.9
1
minio/operator:v5.0.9170b154d2c61
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
minio/operator:v4.1.02adc5be088f5
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9
1
mishtinetwork/operator:latestbb3fe67a5f7c
curl@7.74.0-1.3+deb11u14
7.74.0-1.3+deb11u16
1
mnaggar3396/python-app:latest371d8ed84b15
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
moreillon/face-recognition-fastapi:x86bacb2ddd8394
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
moreillon/mqtt-logger-front:50030b8bfc4d12db1d3e
curl@7.74.0-1.3+deb11u5
7.74.0-1.3+deb11u16
1
mozilla/syncstorage-rs:0.15.893752877dced
curl@7.74.0-1.3+deb11u11
7.74.0-1.3+deb11u16
1
n22107670/sample-app:0.4.08f3072db7aeb
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
n8nio/n8n:1.115.1ed16e560c40e
curl@8.14.1-r1
8.14.1-r2
1
nacos/nacos-server:v3.0.20e951a1d07bb
curl@8.14.1-r0
8.14.1-r2
1
nathanielvarona/pritunl-slack-app:0.1.10b746a34e5597
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
natsio/nats-box:0.18.0abdc9f9f0120
curl@8.14.1-r0
8.14.1-r2
1
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
curl@8.14.1-2
8.14.1-2+deb13u1
1
nginxdemos/hello:plain-text751bf8933179
curl@8.14.1-r1
8.14.1-r2
1
nginxdemos/hello:0.4b28d1e16c676
curl@8.14.1-r1
8.14.1-r2
1
nginxinc/nginx-unprivileged:1.29.0-alpine3.2282dcf28da5a8
curl@8.14.1-r1
8.14.1-r2
1
novumrgi/glowroot-central:0.14.0-beta.38c54790675b1
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
nrrrus/nginx-test:latest5f55cd4ef557
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
ntakashi/gitana:1.4.04171ec641120
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
curl@7.74.0-1.3+deb11u15
7.74.0-1.3+deb11u16
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
curl@7.74.0-1.3+deb11u15
7.74.0-1.3+deb11u16
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.