StackRadar

CVE-2025-9086

High

Advisory

Published 10 Sept 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
579
of 17,787 indexed, latest versions
Container images
632
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: curl security update

Carried by container images the latest versions of 579 of 17,787 indexed charts deploy, on 632 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.74.0-1.3+b1, 7.74.0-1.3+deb11u1, 7.74.0-1.3+deb11u2+12 more7.74.0-1.3+deb11u16, 8.14.1-2+deb13u1, 8.14.1-2+e1, 8.14.1-2ubuntu1.1291
curlapk8.14.0-r2, 8.14.1-r0, 8.14.1-r18.14.1-r235
curlrpm7.61.1-8.el8, 7.61.1-11.el8, 7.61.1-12.el8, 7.61.1-12.el8_2.4+34 more0:7.61.1-34.el8_10.9, 0:7.76.1-23.el9_2.8, 0:7.76.1-29.el9_4.3, 0:7.76.1-31.el9_6.2+2 more306
OSV records
ALPINE-CVE-2025-9086DEBIAN-CVE-2025-9086UBUNTU-CVE-2025-9086RHSA-2025:23043RHSA-2025:23125RHSA-2025:23127RHSA-2025:23383RHSA-2026:1350RHSA-2026:1825RLSA-2025:23383RLSA-2026:1350DLA-4432-1ECHO-6a25-e091-8eb3
Also known as
USN-8062-1

Charts affected

579 by stars
ChartLatestAffected imagesRadar Score
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
erenozcan17/react_frontend:v4.56e1b14973f9b
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

6,974
token-servertoken-server1.0.91 of 1See more

token-server token-server 1.0.9

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
udhos/token-server:1.0.9728013f2fac1
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

1,245
hermestoukVerified publisher0.6.01 of 3See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
apicurio/apicurio-registry-kafkasql:2.1.0.Finala97d67487532
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9

Open the chart page →

12,454
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

3,164
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9

Open the chart page →

1,733
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,370
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9

Open the chart page →

4,960
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
vcnngr/pnfrontend:latest4e4979ab8c41
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

4,769
velero-notificationsvelero-notifications1.1.01 of 1See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,285
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
curl@8.14.1-r1
8.14.1-r2

Open the chart page →

6,470
vinyl-lib-chartvinyl-libVerified publisher0.1.01 of 1See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kporwit/vinyl_lib_app:v0.1.1217de0302218
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

3,392
resultappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repoVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,287
resultappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

1,263
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.02 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_result:v1e510023fdf38
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote:v13a856afb02a3
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

8,287
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16

Open the chart page →

2,019
mediawikiwbstack0.14.01 of 1See more

mediawiki wbstack 0.14.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/wbstack/mediawiki:1.37-7.4-20220621-fp-beta-0c3012c8a34b4
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,132
drillwearefrank1.3.62 of 3See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

9,399
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
curl@7.61.1-18.el8
0:7.61.1-34.el8_10.9

Open the chart page →

28,699
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-nginx:latest6de60c83128d
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

7,552
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
curl@7.61.1-14.el8_3.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,915
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

6,138
wexa-studiowexa-studio1.2.03 of 15See more

wexa-studio wexa-studio 1.2.0

3 of the 15 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
curl@8.14.1-r0
8.14.1-r2
temporalio/server:1.29.1c1e3326b2ce1
curl@8.14.1-r0
8.14.1-r2
quay.io/mongodb/mongodb-kubernetes-operator:0.9.05ee4bd681085
curl@7.61.1-34.el8_10.3
0:7.61.1-34.el8_10.9

Open the chart page →

14,618
vaultwardenwitcom-gmbh0.2.01 of 2See more

vaultwarden witcom-gmbh 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
vaultwarden/server:1.25.239f34c5159a2
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

1,585
wp-gats-helmwordpress-gatsby0.0.11 of 3See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
library/wordpress:6.0.0-php8.0-apache277c6c25980f
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16

Open the chart page →

2,021
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
curl@7.61.1-22.el8
0:7.61.1-34.el8_10.9

Open the chart page →

11,592
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
curl@7.61.1-25.el8_7.1
0:7.61.1-34.el8_10.9

Open the chart page →

6,016
enterprise-gatewayzeet3.2.21 of 2See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
elyra/kernel-image-puller:3.2.2c922f1f1646a
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16

Open the chart page →

1,838
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-9086.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
curl@7.61.1-25.el8_7.3
0:7.61.1-34.el8_10.9

Open the chart page →

3,697

Container images carrying it

632 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
openhab/openhab:3.2.0d0aa4af452c1
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
openzaak/open-zaak:1.6.02ca2ea6e0ae9
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
otel/opentelemetry-ebpf-kernel-collector:v0.10.269e19991e328
curl@7.74.0-1.3+deb11u11
7.74.0-1.3+deb11u16
1
owanio1992/devpi:6.16.04ade8e1e4d7e
curl@7.74.0-1.3+deb11u14
7.74.0-1.3+deb11u16
1
passbolt/passbolt:3.9.0-2-ce-non-rootec046e112d5c
curl@7.74.0-1.3+deb11u5
7.74.0-1.3+deb11u16
1
pecan/web:1.7.2814d678c5550
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
penpotapp/frontend:2.2.18974882a0542
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
percona/percona-postgresql-operator:2.8.06cce2698d3f5
curl@7.76.1-34.el9
0:7.76.1-35.el9_7.3
1
percona/percona-server-mongodb-operator:1.20.1d09453ce7886
curl@7.76.1-31.el9
0:7.76.1-31.el9_6.2
1
percona/percona-xtradb-cluster:8.0.32-24.21f978ab8912e
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9
1
percona/percona-xtradb-cluster-operator:1.14.03232ae01d0ff
curl@7.76.1-26.el9_3.2
0:7.76.1-35.el9_7.3
1
phntom/binaryvision-tlo-static:0.0.4e8b9ac93a3dd
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
phntom/email-manager:0.1.22d8e2a9f2f085
curl@7.74.0-1.3+deb11u5
7.74.0-1.3+deb11u16
1
phntom/external-dns-host-network:0.0.123adadbac8443
curl@7.74.0-1.3+deb11u3
7.74.0-1.3+deb11u16
1
phntom/mattermost-defaultbackend:6.4.0c318dc90a4bf
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
photoprism/photoprism:251130db16ee6b1ba3
curl@8.14.1-2ubuntu1
8.14.1-2ubuntu1.1
1
phpmyadmin/phpmyadmin:5.138437e021deb
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
phpmyadmin/phpmyadmin:5.2.342a200db07b4
curl@8.14.1-2
8.14.1-2+deb13u1
1
pihole/pihole:2023.05.0b83258064f54
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
curl@7.61.1-11.el8
0:7.61.1-34.el8_10.9
1
pnnlmiscscripts/ipmi-exporter:1.2.0-181e18992d8e3
curl@7.61.1-33.el8
0:7.61.1-34.el8_10.9
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
curl@7.61.1-30.el8_8.3
0:7.61.1-34.el8_10.9
1
prodrigestivill/postgres-backup-local:latestf70742ebe42b
curl@8.14.1-2
8.14.1-2+deb13u1
1
ptthanh1511/daloradius:1.2-devafecc5143fcb
curl@7.74.0-1.3+deb11u11
7.74.0-1.3+deb11u16
1
razzy10/product-service:latest702e411956db
curl@7.76.1-31.el9
0:7.76.1-31.el9_6.2
1
remche/shinyproxy:2.6.18bcda8a04d3b
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
reportportal/service-auto-analyzer:5.7.295ada4a216ce
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
reportportal/service-metrics-gatherer:1.1.202a0e6dc11161
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
rm3l/dev-feed-api:latest9a7f732245a3
curl@7.76.1-23.el9_2.4
0:7.76.1-23.el9_2.8
1
rm3l/mac-oui:1.8.03a5e1f95c132
curl@7.61.1-33.el8_9.5
0:7.61.1-34.el8_10.9
1
robmarkcole/deepstack-ui:latest410275726459
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
robotshop/rs-dispatch:latestde81f1d07b02
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
robotshop/rs-payment:latest774b52c6180d
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
robotshop/rs-ratings:latest4899c686c249
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
robotshop/rs-shipping:latest89753ab48919
curl@7.74.0-1.3+b1
7.74.0-1.3+deb11u16
1
roundcube/roundcubemail:1.5.3-apachea8ea6fd751dc
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
salehmir/jesse:1.10.101afa95f979e9
curl@7.74.0-1.3+deb11u12
7.74.0-1.3+deb11u16
1
sarwansharma/minio:v359d1da9385d1
curl@7.61.1-22.el8_6.3
0:7.61.1-34.el8_10.9
1
seataio/seata-server:latest703b5de7f1a6
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
seldonio/seldon-core-operator:1.19.0544e3bf71bd1
curl@7.76.1-34.el9
0:7.76.1-35.el9_7.3
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
curl@7.61.1-18.el8_4.1
0:7.61.1-34.el8_10.9
1
seyiogunniran/my-nginx:1.03a0ed39e5830
curl@8.14.1-r1
8.14.1-r2
1
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
curl@7.61.1-22.el8_6.4
0:7.61.1-34.el8_10.9
1
simpleidserver/faaswebsite:0.0.4367218ae760f
curl@7.74.0-1.3+deb11u1
7.74.0-1.3+deb11u16
1
socialmediamacroscope/classification_predict:0.1.24fb86885d64d
curl@7.74.0-1.3+deb11u5
7.74.0-1.3+deb11u16
1
socialmediamacroscope/classification_split:0.1.24bfda60829fe
curl@7.74.0-1.3+deb11u5
7.74.0-1.3+deb11u16
1
socialmediamacroscope/classification_train:0.1.207477060bba8
curl@7.74.0-1.3+deb11u5
7.74.0-1.3+deb11u16
1
socialmediamacroscope/clowder_create_collection:0.1.0c969f7677983
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
socialmediamacroscope/clowder_create_dataset:0.1.09b4211832429
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1
socialmediamacroscope/clowder_create_space:0.1.0999f2ff2c128
curl@7.74.0-1.3+deb11u7
7.74.0-1.3+deb11u16
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.