CVE-2025-9232

Medium

Advisory

Published 30 Sept 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.020; 80th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,357; of 17,787 indexed, latest versions
Container images: 1,587; deployed by those charts
Fix available: 2 of 3; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,357 of 17,787 indexed charts deploy, on 1,587 images.

Affected package	Affected versions	Fixed in	Images
opensslapk	3.0.7-r0, 3.0.7-r2, 3.0.8-r0, 3.0.8-r1+38 more	3.0.19-r0, 3.1.8-r1, 3.3.5-r0, 3.5.4-r0	970
openssldeb	3.0.9-1, 3.0.11-1~deb12u1, 3.0.11-1~deb12u2, 3.0.13-1~deb12u1+6 more	3.0.17-1~deb12u3, 3.5.1-1+deb13u1	601
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+8 more	no fix listed	16

OSV records: ALPINE-CVE-2025-9232 CGA-3j32-v297-mxhf DEBIAN-CVE-2025-9232 UBUNTU-CVE-2025-9232
Also known as: CGA-vgxf-c52j-3xr7

Charts affected

1,357 by stars

Chart

Latest

Affected images

Radar Score

zooxd

0.4.0

1 of 1 See more

1,955

xkopsxkops

0.1.0

4 of 5 See more

xkops xkops 0.1.0

4 of the 5 container images this version deploys carry CVE-2025-9232.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	openssl@3.0.14-1~deb12u2	3.0.17-1~deb12u3
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	openssl@3.3.2-r0	3.3.5-r0
hamzaarshad10/querypodpy :1.7	154f38e8668e	openssl@3.0.14-1~deb12u2	3.0.17-1~deb12u3
murtazashah46/helmfile :latest	4d11726cf803	openssl@3.0.14-1~deb12u2	3.0.17-1~deb12u3

Open the chart page →

13,197

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2025-9232.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	openssl@3.3.2-r0	3.3.5-r0

Open the chart page →

9,381

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-9232.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	openssl@3.0.11-1~deb12u2	3.0.17-1~deb12u3

Open the chart page →

2,674

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-9232.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	openssl@3.0.9-r1	3.0.19-r0
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	openssl@3.0.9-r1	3.0.19-r0

Open the chart page →

5,033

zahori-serverzahori

1.0.1

2 of 2 See more

zahori-server zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-9232.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	openssl@3.0.7-r2	3.0.19-r0
zahoriaut/zahori-server :0.1.17	b2de13916f3e	openssl@3.0.8-r3	3.0.19-r0

Open the chart page →

5,847

zerossl-cert-managerzerossl-cert-manager

0.1.0

1 of 2 See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-9232.

Container image	Digest	Package	Fixed in
andreymileshin/zerossl-issuer :v1.0.0	e0825acc9e48	openssl@3.1.7-r0	3.1.8-r1

Open the chart page →

569

Container images carrying it

1,587 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
rookout/controller :latest	4451a6f6b8ec	openssl@3.0.11-r0	3.0.19-r0	2
rookout/data-on-prem :latest	51c0fce64467	openssl@3.0.11-r0	3.0.19-r0	2
shahanafarooqui/rtl :0.13.3	e2195188a451	openssl@3.0.7-r0	3.0.19-r0	2
speckle/speckle-preview-service :2.18.11-branch.testing2.88634-335d469 :2.18.12-branch.testing3.88744-f55b341	4bd113093583	openssl@3.0.11-1~deb12u2	3.0.17-1~deb12u3	2
sysnet4admin/dashboard :blue	c5bd3bb1b5a6	openssl@3.3.3-r0	3.3.5-r0	2
taigaio/taiga-front :latest	570c8792ce80	openssl@3.0.8-r3	3.0.19-r0	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	nodejs@16.14.2-deb-1nodesource1	no fix listed	2
uffizzi/controller :latest	0344805f267b	openssl@3.0.11-1~deb12u2	3.0.17-1~deb12u3	2
uselagoon/docker-host :v3.6.1	2c89ed939b8b	openssl@3.3.3-r0	3.3.5-r0	2
vdiogov/glpi-conteiner :latest	6945f84f0058	openssl@3.0.13-1~deb12u1	3.0.17-1~deb12u3	2
ghcr.io/airflow-helm/pgbouncer :1.22.1-patch.0	c181abe1093d	openssl@3.1.4-r6	3.1.8-r1	2
ghcr.io/airflow-helm/postgresql-bitnami :11.22-patch.0	df576862b7c0	openssl@3.1.4-r5	3.1.8-r1	2
ghcr.io/appscode/kube-auth-manager :v0.0.1	789692ab9193	openssl@3.0.8-r3	3.0.19-r0	2
ghcr.io/astriaorg/astria-geth :latest	4249e403225a	openssl@3.5.0-r0	3.5.4-r0	2
ghcr.io/astriaorg/conductor :latest	3ea8164b0eae	openssl@3.0.17-1~deb12u2	3.0.17-1~deb12u3	2
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	openssl@3.3.1-r3	3.3.5-r0	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	nodejs@16.18.0-deb-1nodesource1	no fix listed	2
ghcr.io/containerd/nydus-snapshotter :v0.9.0	56f8617363b4	openssl@3.0.7-r0	3.0.19-r0	2
ghcr.io/cosmos/gaia :v25.1.0	f115777d1112	openssl@3.5.0-r0	3.5.4-r0	2
ghcr.io/cross-seed/cross-seed :6.13.3	81afafdd96a5	openssl@3.5.1-r0	3.5.4-r0	2
ghcr.io/eosc-lot-1/curl-jq :8	156beafae7ca	openssl@3.1.4-r5	3.1.8-r1	2
ghcr.io/eosc-lot-1/s3cmd :2-alpine	49bce0dd876d	openssl@3.1.4-r6	3.1.8-r1	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	openssl@3.0.13-1~deb12u1	3.0.17-1~deb12u3	2
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	openssl@3.5.1-r0	3.5.4-r0	2
ghcr.io/home-operations/readarr :0.4.18 :0.4.18.2805	8f7551205fbd	openssl@3.5.0-r0	3.5.4-r0	2
ghcr.io/immich-app/postgres :14-vectorchord0.4.3-pgvectors0.2.0	bcf63357191b	openssl@3.0.17-1~deb12u2	3.0.17-1~deb12u3	2
ghcr.io/kiwigrid/k8s-sidecar :1.29.1	42002d66ddb3	openssl@3.3.2-r4	3.3.5-r0	2
ghcr.io/matrix-org/sliding-sync :v0.99.19	b940cab56435	openssl@3.0.13-r0	3.0.19-r0	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	openssl@3.0.14-1~deb12u2	3.0.17-1~deb12u3	2
ghcr.io/nucleuscloud/neosync/api :0.5.41	e2abb798f29f	openssl@3.0.16-1~deb12u1	3.0.17-1~deb12u3	2
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	openssl@3.5.0-r0	3.5.4-r0	2
ghcr.io/nucleuscloud/neosync/worker :0.5.41	96f42450c5b1	openssl@3.0.16-1~deb12u1	3.0.17-1~deb12u3	2
ghcr.io/postgresml/pgcat :main	245f9d2f5f5b	openssl@3.0.11-1~deb12u2	3.0.17-1~deb12u3	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	openssl@3.0.15-1~deb12u1	3.0.17-1~deb12u3	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	openssl@3.0.15-1~deb12u1	3.0.17-1~deb12u3	2
ghcr.io/smarter-project/home-orchestrator :main	d44135b02d77	openssl@3.1.8-r0	3.1.8-r1	2
ghcr.io/techno-tim/littlelink-server :latest	e84ea9d93b60	openssl@3.1.4-r5	3.1.8-r1	2
ghcr.io/thecatlady/webhook :2.8.0	f04718704dab	openssl@3.0.8-r0	3.0.19-r0	2
ghcr.io/wg-easy/wg-easy :14	5f26407fd2ed	openssl@3.5.0-r0	3.5.4-r0	2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	openssl@3.5.1-1	3.5.1-1+deb13u1	2
quay.io/curl/curl :8.16.0	b17b13321678	openssl@3.5.2-r0	3.5.4-r0	2
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	openssl@3.1.4-r5	3.1.8-r1	2
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	openssl@3.3.0-r2	3.3.5-r0	2
registry.k8s.io/ingress-nginx/controller :v1.11.8	695d79381ee6	openssl@3.5.0-r0	3.5.4-r0	2
registry.k8s.io/ingress-nginx/controller :v1.9.5	b3aba22b1da8	openssl@3.1.4-r2	3.1.8-r1	2
registry.k8s.io/ingress-nginx/controller :v1.12.1	d2fbc4ec70d8	openssl@3.3.3-r0	3.3.5-r0	2
0hlov3/semaphore :v1.0.0	50f874ec096b	openssl@3.0.8-r0	3.0.19-r0	1
2martens/configserver :latest	bf1cdb80239d	openssl@3.3.1-r3	3.3.5-r0	1
2martens/timetable :latest	bd1ba6ab84c9	openssl@3.5.1-r0	3.5.4-r0	1
2martens/wahlrecht :latest	ba2c3040dab0	openssl@3.5.1-r0	3.5.4-r0	1