CVE-2025-9086

High

Advisory

Published 10 Sept 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.014; 71st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 579; of 17,787 indexed, latest versions
Container images: 632; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: curl security update

Carried by container images the latest versions of 579 of 17,787 indexed charts deploy, on 632 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.74.0-1.3+b1, 7.74.0-1.3+deb11u1, 7.74.0-1.3+deb11u2+12 more	7.74.0-1.3+deb11u16, 8.14.1-2+deb13u1, 8.14.1-2+e1, 8.14.1-2ubuntu1.1	291
curlapk	8.14.0-r2, 8.14.1-r0, 8.14.1-r1	8.14.1-r2	35
curlrpm	7.61.1-8.el8, 7.61.1-11.el8, 7.61.1-12.el8, 7.61.1-12.el8_2.4+34 more	0:7.61.1-34.el8_10.9, 0:7.76.1-23.el9_2.8, 0:7.76.1-29.el9_4.3, 0:7.76.1-31.el9_6.2+2 more	306

OSV records: ALPINE-CVE-2025-9086 DEBIAN-CVE-2025-9086 UBUNTU-CVE-2025-9086 RHSA-2025:23043 RHSA-2025:23125 RHSA-2025:23127 RHSA-2025:23383 RHSA-2026:1350 RHSA-2026:1825 RLSA-2025:23383 RLSA-2026:1350 DLA-4432-1 ECHO-6a25-e091-8eb3
Also known as: USN-8062-1

Charts affected

579 by stars

Chart

Latest

Affected images

Radar Score

todolist-charttodolist-chart

0.1.7

1 of 10 See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
erenozcan17/react_frontend :v4.5	6e1b14973f9b	curl@8.14.1-r1	8.14.1-r2

Open the chart page →

6,974

token-servertoken-server

1.0.9

1 of 1 See more

token-server token-server 1.0.9

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
udhos/token-server :1.0.9	728013f2fac1	curl@8.14.1-r1	8.14.1-r2

Open the chart page →

1,245

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	curl@7.61.1-18.el8	0:7.61.1-34.el8_10.9

Open the chart page →

12,454

synapsetranhailong

0.1.0

1 of 2 See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
matrixdotorg/synapse :v1.78.0	def97fd537d8	curl@7.74.0-1.3+deb11u7	7.74.0-1.3+deb11u16

Open the chart page →

3,164

zookeepertwomartens

0.2.2

1 of 1 See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
confluentinc/cp-zookeeper :latest	7610a50b13e7	curl@7.61.1-34.el8_10.3	0:7.61.1-34.el8_10.9

Open the chart page →

1,733

jupyterhubuninettsigma2

1.6.0

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16

Open the chart page →

8,370

miniouninettsigma2

1.2.0

1 of 1 See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
sigma2as/minio :20240306-3a2e4f5	c284ead9ec3e	curl@7.61.1-22.el8_6.4	0:7.61.1-34.el8_10.9

Open the chart page →

4,960

simple-prima-notavcnngr

0.5.3

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
vcnngr/pnfrontend :latest	4e4979ab8c41	curl@8.14.1-r1	8.14.1-r2

Open the chart page →

4,769

velero-notificationsvelero-notifications

1.1.0

1 of 1 See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
ghcr.io/simoncaron/velero-notifications :1.0.0	d058963d4de7	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16

Open the chart page →

1,285

n8nvictorlane

1.0.18

1 of 1 See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
n8nio/n8n :1.115.1	ed16e560c40e	curl@8.14.1-r1	8.14.1-r2

Open the chart page →

6,470

vinyl-lib-chartvinyl-lib

0.1.0

1 of 1 See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
kporwit/vinyl_lib_app :v0.1.1	217de0302218	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16

Open the chart page →

3,392

resultappvoting-app-helm-charts-repo

1.0.0

1 of 1 See more

resultapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
kodekloud/examplevotingapp_result :v1	e510023fdf38	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16

Open the chart page →

1,263

voteappvoting-app-helm-charts-repo

1.0.0

2 of 5 See more

voteapp voting-app-helm-charts-repo 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
kodekloud/examplevotingapp_result :v1	e510023fdf38	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote :v1	3a856afb02a3	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16

Open the chart page →

8,287

resultappvoting-app-helm-charts-repo-cloud

1.0.0

1 of 1 See more

resultapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
kodekloud/examplevotingapp_result :v1	e510023fdf38	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16

Open the chart page →

1,263

voteappvoting-app-helm-charts-repo-cloud

1.0.0

2 of 5 See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

2 of the 5 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
kodekloud/examplevotingapp_result :v1	e510023fdf38	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16
kodekloud/examplevotingapp_vote :v1	3a856afb02a3	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16

Open the chart page →

8,287

apiwbstack

0.36.0

1 of 1 See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/api :8x.9.11	eee94f9f7a53	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16

Open the chart page →

2,019

mediawikiwbstack

0.14.0

1 of 1 See more

mediawiki wbstack 0.14.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/mediawiki :1.37-7.4-20220621-fp-beta-0	c3012c8a34b4	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16

Open the chart page →

2,132

drillwearefrank

1.3.6

2 of 3 See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
apache/drill :1.21.1	1f96558fd292	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16
bitnamilegacy/zookeeper :3.9.0-debian-11-r11	10ed1ea3c8d1	curl@7.74.0-1.3+deb11u7	7.74.0-1.3+deb11u16

Open the chart page →

9,399

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	curl@7.61.1-18.el8	0:7.61.1-34.el8_10.9

Open the chart page →

28,699

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-nginx :latest	6de60c83128d	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16

Open the chart page →

7,552

miniowenerme

8.0.10

1 of 1 See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	curl@7.61.1-14.el8_3.1	0:7.61.1-34.el8_10.9

Open the chart page →

6,915

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	curl@7.61.1-22.el8	0:7.61.1-34.el8_10.9

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

3 of 15 See more

wexa-studio wexa-studio 1.2.0

3 of the 15 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	curl@8.14.1-r0	8.14.1-r2
temporalio/server :1.29.1	c1e3326b2ce1	curl@8.14.1-r0	8.14.1-r2
quay.io/mongodb/mongodb-kubernetes-operator :0.9.0	5ee4bd681085	curl@7.61.1-34.el8_10.3	0:7.61.1-34.el8_10.9

Open the chart page →

14,618

vaultwardenwitcom-gmbh

0.2.0

1 of 2 See more

vaultwarden witcom-gmbh 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
vaultwarden/server :1.25.2	39f34c5159a2	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16

Open the chart page →

1,585

wp-gats-helmwordpress-gatsby

0.0.1

1 of 3 See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
library/wordpress :6.0.0-php8.0-apache	277c6c25980f	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16

Open the chart page →

2,021

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	curl@7.61.1-22.el8	0:7.61.1-34.el8_10.9

Open the chart page →

11,592

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	curl@7.61.1-25.el8_7.1	0:7.61.1-34.el8_10.9

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	curl@7.74.0-1.3+deb11u7	7.74.0-1.3+deb11u16

Open the chart page →

1,838

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-9086.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	curl@7.61.1-25.el8_7.3	0:7.61.1-34.el8_10.9

Open the chart page →

3,697

Container images carrying it

632 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/appuio/cloud-portal :v0.2.1	8c7e08d32d70	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/appuio/maxscale-docker :6.4.6	13a01be102b0	curl@7.61.1-25.el8_7.3	0:7.61.1-34.el8_10.9	1
ghcr.io/b-it-projects-gmbh/nvme_exporter :latest	e70307b193c6	curl@8.14.1-r0	8.14.1-r2	1
ghcr.io/blakeblackshear/frigate :0.14.1	22e3d0b486df	curl@7.74.0-1.3+deb11u12	7.74.0-1.3+deb11u16	1
ghcr.io/blakeblackshear/frigate :0.13.0	7a5244e4c8dc	curl@7.74.0-1.3+deb11u11	7.74.0-1.3+deb11u16	1
ghcr.io/blakeblackshear/frigate :0.12.0	c862771e38e8	curl@7.74.0-1.3+deb11u7	7.74.0-1.3+deb11u16	1
ghcr.io/chatwoot/pgvector :14.4.0-debian-11-r0	f759f1510d09	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/codingducksrl/wordpress :6.0.2	3113c0960507	curl@7.74.0-1.3+deb11u3	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/berichtservice-nginx :latest	833d26df3840	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/contactcatalogus-nginx :latest	480c84fa9e63	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/digispoof-interface-nginx :latest	8fa4597217a4	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/eav-component-nginx :latest	d785c893096c	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/education-component-nginx :latest	38900bc76ee0	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/medewerkercatalogus-nginx :latest	06c3b27462e6	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/skeleton-pip :dev	ce1ebe9387a2	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/user-component-nginx :latest	b721579df8c3	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/waardepapieren-nginx :latest	af31cf6cd59f	curl@7.74.0-1.3+b1	7.74.0-1.3+deb11u16	1
ghcr.io/conductionnl/webresourcecatalogus-nginx :latest	6de60c83128d	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/ctron/ditto-operator :0.4.0	61a9bb81b85c	curl@7.61.1-22.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/ctron/kubectl :1.25	e37d61b5277c	curl@7.61.1-33.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/ctron/streamsheets-base :2.4.0	0cf25ed621e2	curl@7.61.1-18.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/ctron/streamsheets-gateway :2.4.0	0635f17c9d2c	curl@7.61.1-18.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	curl@7.61.1-18.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	curl@7.61.1-18.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	curl@7.61.1-18.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/devops-ia/cp-schema-registry :8.1.1-msk-iam-auth2.3.5	30d1a445acc7	curl@7.76.1-34.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	curl@8.14.1-2	8.14.1-2+deb13u1	1
ghcr.io/drogue-iot/authentication-service :0.11.0	857b137fc7b3	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/coap-endpoint :0.11.0	44790b71aa22	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/command-endpoint :0.11.0	6dce3158b851	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/console-backend :0.11.0	25d229ae5bde	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/console-frontend :0.11.0	558972f9374c	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/database-migration :0.11.0	57072c72a7cd	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/device-management-controller :0.11.0	200aea1a2b42	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/device-management-service :0.11.0	f4a5bfc06a74	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/device-state-service :0.11.0	fbf0738cfc7e	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/drogue-event-source :0.2.1	e2e812a4cf8e	curl@7.61.1-22.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/drogue-iot/http-endpoint :0.11.0	b612c18479e0	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/knative-operator :0.11.0	e2d927639f6e	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/mqtt-endpoint :0.11.0	32c6d2f5eab9	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/mqtt-integration :0.11.0	7ac2adb6ca49	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/outbox-controller :0.11.0	1a958edafdb1	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/postgresql-pusher :0.2.1	c6bb121ced90	curl@7.61.1-22.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/drogue-iot/test-cert-generator :0.11.0	6ba7e1608286	curl@7.61.1-25.el8	0:7.61.1-34.el8_10.9	1
ghcr.io/drogue-iot/topic-strimzi-operator :0.11.0	5253fbf8d04c	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/ttn-operator :0.11.0	7dd5ac80c8f1	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/user-auth-service :0.11.0	adebc40ddf98	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/drogue-iot/websocket-integration :0.11.0	372dcd370945	curl@7.76.1-19.el9	0:7.76.1-35.el9_7.3	1
ghcr.io/ducksify/pgdump-to-s3 :latest	c42c0946bd0f	curl@7.74.0-1.3+deb11u1	7.74.0-1.3+deb11u16	1
ghcr.io/facebook/threatexchange/hma :1.0.17	84d09c6b75a7	curl@7.74.0-1.3+deb11u14	7.74.0-1.3+deb11u16	1