CVE-2025-54410
Fixed in a distro release EPSS <1%CVSS 3.3
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected. Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.
Products: moby
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/docker/docker | 25.0.13 |
| Go | github.com/docker/docker | 28.0.0 |
| Go | github.com/docker/docker | 25.0.13+incompatible |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | docker | 25.0.13-1.amzn2023.0.1 |
| Chainguard | aactl | 0.4.12-r39 |
| Chainguard | aactl | 0.4.12-r35 |
| Chainguard | amazon-cloudwatch-agent-operator | 3.3.1-r0 |
| Chainguard | amazon-cloudwatch-agent-operator-fips | 3.3.1-r0 |
| Chainguard | amazon-ecs-agent | 1.99.0-r0 |
| Chainguard | amazon-ecs-agent-fips | 1.99.0-r0 |
| Chainguard | auditbeat-8.17 | no fix |
| Chainguard | auditbeat-8.18 | 8.18.8-r12 |
| Chainguard | auditbeat-9.0 | 9.0.7-r1 |
| Chainguard | auditbeat-9.0-oci-entrypoint | 9.0.7-r1 |
| Chainguard | auditbeat-fips-8.17 | no fix |
| Chainguard | auditbeat-fips-8.18 | no fix |
| Chainguard | auditbeat-fips-9.0 | 9.0.7-r1 |
| Chainguard | beats-8.18 | 8.18.8-r2 |
| Chainguard | beats-9.0 | 9.0.7-r1 |
| Chainguard | beats-fips-9.0 | 9.0.7-r1 |
| Chainguard | bento | 1.10.0-r1 |
| Chainguard | bento-compat | 1.10.0-r1 |
| Chainguard | bom | 0.6.0-r24 |
| Chainguard | cloudbeat-8.17 | no fix |
| Chainguard | cloudbeat-8.18 | no fix |
| Chainguard | cloudbeat-9.0 | no fix |
| Chainguard | cloudbeat-fips-8.17 | no fix |
| Chainguard | cloudbeat-fips-8.18 | no fix |
| Chainguard | cloudbeat-fips-9.0 | no fix |
| Chainguard | cluster-api-1.7-capd-manager | no fix |
| Chainguard | cluster-api-1.8 | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-capd-manager | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-capd-manager-compat | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-clusterctl | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-clusterctl-compat | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-controller | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-controller-compat | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-kubeadm-bootstrap-controller | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-kubeadm-bootstrap-controller-compat | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-kubeadm-control-plane-controller | 1.8.12-r4 |
| Chainguard | cluster-api-1.8-kubeadm-control-plane-controller-compat | 1.8.12-r4 |
| Chainguard | cluster-api-1.9 | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-capd-manager | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-capd-manager-compat | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-clusterctl | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-clusterctl-compat | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-controller | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-controller-compat | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-kubeadm-bootstrap-controller | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-kubeadm-bootstrap-controller-compat | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-kubeadm-control-plane-controller | 1.9.11-r0 |
| Chainguard | cluster-api-1.9-kubeadm-control-plane-controller-compat | 1.9.11-r0 |
| Chainguard | cluster-api-fips-1.7-capd-manager | no fix |
| Chainguard | cluster-api-fips-1.8 | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-capd-manager | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-capd-manager-compat | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-clusterctl | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-clusterctl-compat | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-controller | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-controller-compat | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-kubeadm-bootstrap-controller | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-kubeadm-bootstrap-controller-compat | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-kubeadm-control-plane-controller | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.8-kubeadm-control-plane-controller-compat | 1.8.12-r1 |
| Chainguard | cluster-api-fips-1.9 | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-capd-manager | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-capd-manager-compat | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-clusterctl | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-clusterctl-compat | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-controller | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-controller-compat | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-kubeadm-bootstrap-controller | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-kubeadm-bootstrap-controller-compat | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-kubeadm-control-plane-controller | 1.9.10-r1 |
| Chainguard | cluster-api-fips-1.9-kubeadm-control-plane-controller-compat | 1.9.10-r1 |
| Chainguard | cluster-api-helm-controller | 0.3.2-r4 |
| Chainguard | cluster-api-helm-controller-compat | 0.3.2-r4 |
| Chainguard | cluster-api-helm-controller-fips | 0.3.2-r5 |
| Chainguard | cluster-api-helm-controller-fips-compat | 0.3.2-r5 |
| Chainguard | consul-k8s-fips-1.4-cli | 1.4.10-r25 |
| Chainguard | crossplane-crank | 2.0.2-r1 |
| Chainguard | ctop | 0.7.7-r38 |
| Chainguard | docker-credential-gcr | 2.1.30-r3 |
| Chainguard | docker-credential-gcr-fips | 2.1.30-r3 |
| Chainguard | drone | no fix |
| Chainguard | drone-fips | no fix |
| Chainguard | elastic-agent-8.17 | no fix |
| Chainguard | elastic-agent-8.18 | no fix |
| Chainguard | elastic-agent-9.0 | no fix |
| Chainguard | elastic-agent-fips-8.17 | no fix |
| Chainguard | elastic-agent-fips-8.18 | no fix |
| Chainguard | elastic-agent-fips-9.0 | no fix |
| Chainguard | falco | 0.42.0-r0 |
| Chainguard | falco-dev | 0.42.0-r0 |
| Chainguard | falco-src | 0.42.0-r0 |
| Chainguard | falcoctl | 0.11.2-r5 |
| Chainguard | falcoctl-fips | 0.11.2-r6 |
| Chainguard | falcoctl-fips-0.4 | 0.4.0-r24 |
| Chainguard | filebeat-8.17 | no fix |
| Chainguard | filebeat-8.18 | 8.18.8-r12 |
| Chainguard | filebeat-9.0 | 9.0.7-r1 |
| Chainguard | filebeat-9.0-oci-entrypoint | 9.0.7-r1 |
| Chainguard | filebeat-fips-8.17 | no fix |
| Chainguard | filebeat-fips-8.18 | no fix |
| Chainguard | filebeat-fips-9.0 | 9.0.7-r1 |
| Chainguard | gatekeeper-3.18 | 3.18.3-r8 |
| Chainguard | gatekeeper-3.18-compat | 3.18.3-r8 |
| Chainguard | gatekeeper-3.18-crds | 3.18.3-r8 |
| Chainguard | gatekeeper-3.18-crds-compat | 3.18.3-r8 |
| Chainguard | gatekeeper-3.18-gator | 3.18.3-r8 |
| Chainguard | gatekeeper-3.19 | 3.19.3-r3 |
| Chainguard | gatekeeper-3.19-compat | 3.19.3-r3 |
| Chainguard | gatekeeper-3.19-crds | 3.19.3-r3 |
| Chainguard | gatekeeper-3.19-crds-compat | 3.19.3-r3 |
| Chainguard | gatekeeper-3.19-gator | 3.19.3-r3 |
| Chainguard | gitlab-docker-machine-18.6 | no fix |
| Chainguard | gitlab-docker-machine-fips-18.6 | 0 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r7 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r1 |
| Chainguard | gitlab-rails-ce-18.2 | 18.2.8-r3 |
| Chainguard | gitlab-rails-ce-18.2 | 18.2.8-r1 |
| Chainguard | gitlab-rails-ce-18.3 | 18.3.2-r1 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 18.3.2-r1 |
| Chainguard | gitlab-rails-ce-doc-18.3 | 18.3.2-r1 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r2 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r7 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 18.2.8-r5 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 18.2.8-r2 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 18.3.5-r2 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 18.3.6-r4 |
| Chainguard | gitlab-rails-ce-fips-18.4 | 18.4.6-r3 |
| Chainguard | gitlab-rails-ce-fips-18.4 | 18.4.3-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 18.5.5-r1 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 18.5.1-r2 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 18.6.6-r1 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 18.6.1-r2 |
| Chainguard | gitlab-rails-ce-fips-18.7 | 18.7.0-r0 |
| Chainguard | gitlab-rails-ce-fips-18.7 | 18.7.4-r1 |
| Chainguard | gitlab-rails-ce-fips-18.8 | 18.8.4-r1 |
| Chainguard | gitlab-runner-fips-18.6 | 0 |
| Chainguard | gitlab-runner-helper-compat-fips-18.6 | 0 |
| Chainguard | gitlab-runner-helper-fips-18.6 | 0 |
| Chainguard | gitlab-runner-helper-oci-entrypoint-fips-18.6 | 0 |
| Chainguard | gitlab-runner-oci-entrypoint-fips-18.6 | 0 |
| Chainguard | gitness | no fix |
| Chainguard | harbor-2.11 | 2.11.2-r19 |
| Chainguard | harbor-2.11-exporter | 2.11.2-r19 |
| Chainguard | harbor-2.11-jobservice | 2.11.2-r19 |
| Chainguard | harbor-2.11-photon-registry | 2.11.2-r19 |
| Chainguard | harbor-2.11-portal | 2.11.2-r19 |
| Chainguard | harbor-2.11-portal-nginx-config | 2.11.2-r19 |
| Chainguard | harbor-2.11-redis-compat | 2.11.2-r19 |
| Chainguard | harbor-2.11-registryctl | 2.11.2-r19 |
| Chainguard | harbor-fips-2.11 | 2.11.2-r23 |
| Chainguard | harbor-fips-2.11-db | 2.11.2-r23 |
| Chainguard | harbor-fips-2.11-exporter | 2.11.2-r23 |
| Chainguard | harbor-fips-2.11-jobservice | 2.11.2-r23 |
| Chainguard | harbor-fips-2.11-photon-registry | 2.11.2-r23 |
| Chainguard | harbor-fips-2.11-portal | 2.11.2-r23 |
| Chainguard | harbor-fips-2.11-redis-compat | 2.11.2-r23 |
| Chainguard | harbor-fips-2.11-registryctl | 2.11.2-r23 |
| Chainguard | harbor-scanner-trivy | 0.33.2-r2 |
| Chainguard | harbor-scanner-trivy-fips | 0.31.4-r13 |
| Chainguard | harvester | 1.8.1-r11 |
| Chainguard | harvester-fips | 1.8.1-r11 |
| Chainguard | harvester-fips-webhook | 1.8.1-r11 |
| Chainguard | harvester-webhook | 1.8.1-r11 |
| Chainguard | heartbeat-8.17 | no fix |
| Chainguard | heartbeat-8.18 | 8.18.8-r12 |
| Chainguard | heartbeat-9.0 | 9.0.7-r1 |
| Chainguard | heartbeat-9.0-oci-entrypoint | 9.0.7-r1 |
| Chainguard | heartbeat-fips-8.17 | no fix |
| Chainguard | heartbeat-fips-8.18 | no fix |
| Chainguard | heartbeat-fips-9.0 | 9.0.7-r1 |
| Chainguard | heartbeat-fips-9.0-oci-entrypoint | 9.0.7-r1 |
| Chainguard | helm-mapkubeapis | 0.6.1-r2 |
| Chainguard | helm-set-status | 0.3.0-r2 |
| Chainguard | istio-cni-fips-1.23 | 1.23.6-r12 |
| Chainguard | istio-cni-fips-1.23-compat | 1.23.6-r12 |
| Chainguard | istio-fips-1.23 | 1.23.6-r12 |
| Chainguard | istio-install-cni-fips-1.23 | 1.23.6-r12 |
| Chainguard | istio-install-cni-fips-1.23-compat | 1.23.6-r12 |
| Chainguard | istio-operator-fips-1.23 | 1.23.6-r12 |
| Chainguard | istio-pilot-agent-fips-1.23 | 1.23.6-r12 |
| Chainguard | istio-pilot-agent-fips-1.23-compat | 1.23.6-r12 |
| Chainguard | istio-pilot-discovery-fips-1.23 | 1.23.6-r12 |
| Chainguard | k3d | 5.8.3-r16 |
| Chainguard | k3d-proxy | 5.8.3-r16 |
| Chainguard | k3d-tools | 5.8.3-r16 |
| Chainguard | k3s | 1.36.1.1-r0 |
| Chainguard | k3s-1.31 | 1.31.6.1-r8 |
| Chainguard | k3s-1.32 | 1.32.13.1-r2 |
| Chainguard | k3s-1.33 | 1.33.10.1-r5 |
| Chainguard | k3s-1.34 | 1.34.8.1-r0 |
| Chainguard | k3s-1.35 | 1.35.3.1-r8 |
| Chainguard | k3s-multicall | 1.34.1.1-r2 |
| Chainguard | k3s-multicall-1.31 | 1.31.6.1-r8 |
| Chainguard | k3s-multicall-1.32 | 1.32.9.1-r2 |
| Chainguard | k3s-multicall-1.33 | 1.33.5.1-r2 |
| Chainguard | k3s-static | 1.36.1.1-r0 |
| Chainguard | k3s-static-1.31 | 1.31.6.1-r8 |
| Chainguard | k3s-static-1.32 | 1.32.13.1-r2 |
| Chainguard | k3s-static-1.33 | 1.33.10.1-r5 |
| Chainguard | k3s-static-1.34 | 1.34.8.1-r0 |
| Chainguard | k3s-static-1.35 | 1.35.3.1-r8 |
| Chainguard | katib-controller | 0.18.0-r8 |
| Chainguard | katib-controller-compat | 0.18.0-r8 |
| Chainguard | katib-db-manager | 0.18.0-r8 |
| Chainguard | katib-db-manager-compat | 0.18.0-r8 |
| Chainguard | katib-earlystopping | 0.18.0-r8 |
| Chainguard | katib-file-metricscollector | 0.18.0-r8 |
| Chainguard | katib-file-metricscollector-compat | 0.18.0-r8 |
| Chainguard | katib-suggestion-goptuna | 0.18.0-r8 |
| Chainguard | katib-suggestion-goptuna-compat | 0.18.0-r8 |
| Chainguard | katib-suggestion-hyperband | 0.18.0-r8 |
| Chainguard | katib-suggestion-hyperopt | 0.18.0-r8 |
| Chainguard | katib-suggestion-nas-darts | 0.18.0-r8 |
| Chainguard | katib-suggestion-nas-enas | 0.18.0-r8 |
| Chainguard | katib-suggestion-optuna-enas | 0.18.0-r8 |
| Chainguard | katib-suggestion-pbt-enas | 0.18.0-r8 |
| Chainguard | katib-suggestion-skopt-enas | 0.18.0-r8 |
| Chainguard | katib-tfevent-metricscollector | 0.18.0-r8 |
| Chainguard | kpt | 1.0.0_beta55-r11 |
| Chainguard | kube-arangodb | 1.3.0-r2 |
| Chainguard | kube-arangodb-compat | 1.3.0-r2 |
| Chainguard | kube-arangodb-fips | 1.3.0-r2 |
| Chainguard | kube-arangodb-fips-compat | 1.3.0-r2 |
| Chainguard | kubeflow-katib | 0.18.0-r8 |
| Chainguard | kubevirt-cdi-uploadserver-1.5 | 1.59.2-r6 |
| Chainguard | kyverno-1.12 | 1.12.7-r19 |
| Chainguard | kyverno-background-controller-1.12 | 1.12.7-r19 |
| Chainguard | kyverno-cleanup-controller-1.12 | 1.12.7-r19 |
| Chainguard | kyverno-cli-1.12 | 1.12.7-r19 |
| Chainguard | kyverno-init-container-1.12 | 1.12.7-r19 |
| Chainguard | kyverno-reports-controller-1.12 | 1.12.7-r19 |
| Chainguard | lazydocker | 0.24.1-r6 |
| Chainguard | loki-2.9-promtail | no fix |
| Chainguard | loki-3.4-promtail | no fix |
| Chainguard | loki-fips-2.9-promtail | no fix |
| Chainguard | loki-fips-3.4-promtail | no fix |
| Chainguard | metricbeat-8.17 | no fix |
| Chainguard | metricbeat-8.18 | 8.18.8-r12 |
| Chainguard | metricbeat-9.0 | 9.0.7-r1 |
| Chainguard | metricbeat-9.0-oci-entrypoint | 9.0.7-r1 |
| Chainguard | metricbeat-fips-8.17 | no fix |
| Chainguard | metricbeat-fips-8.18 | no fix |
| Chainguard | metricbeat-fips-9.0 | 9.0.7-r1 |
| Chainguard | neuvector-scanner-fips | 0_git20240528-r12 |
| Chainguard | neuvector-scanner-task-fips | 0_git20240528-r12 |
| Chainguard | newrelic-infrastructure-agent | 1.66.1-r1 |
| Chainguard | openbao | 2.4.3-r0 |
| Chainguard | openbao-fips | 2.4.3-r0 |
| Chainguard | opentelemetry-operator | 0.131.0-r1 |
| Chainguard | opentelemetry-operator-compat | 0.131.0-r1 |
| Chainguard | opentelemetry-operator-fips | 0.131.0-r3 |
| Chainguard | opentelemetry-operator-fips-otel-allocator | 0.131.0-r3 |
| Chainguard | opentelemetry-operator-otel-allocator | 0.131.0-r1 |
| Chainguard | opentelemetry-operator-otel-allocator-compat | 0.131.0-r1 |
| Chainguard | portieris | 0.13.30-r1 |
| Chainguard | portieris-compat | 0.13.30-r1 |
| Chainguard | portieris-fips | 0.13.30-r1 |
| Chainguard | prometheus-2.51 | no fix |
| Chainguard | prometheus-2.53 | no fix |
| Chainguard | prometheus-3.2 | 3.2.1-r48 |
| Chainguard | prometheus-3.2-bitnami-compat | 3.2.1-r48 |
| Chainguard | prometheus-3.2-iamguarded-compat | 3.2.1-r48 |
| Chainguard | promxy | 0.0.94-r0 |
| Chainguard | promxy-fips | 0.0.94-r0 |
| Chainguard | rancher-2.10 | no fix |
| Chainguard | rancher-2.11 | no fix |
| Chainguard | rancher-2.12 | 2.12.1-r0 |
| Chainguard | rancher-agent-2.10 | no fix |
| Chainguard | rancher-agent-2.11 | no fix |
| Chainguard | rancher-agent-2.12 | 2.12.11-r0 |
| Chainguard | rancher-agent-2.13 | 2.13.0-r1 |
| Chainguard | rancher-agent-2.9 | no fix |
| Chainguard | rancher-machine | 0.15.0.144-r0 |
| Chainguard | redpanda-25.1-compat | 25.1.10-r1 |
| Chainguard | rke2-runtime-1.31 | no fix |
| Chainguard | rke2-runtime-1.32 | no fix |
| Chainguard | rke2-runtime-1.33 | 1.33.13.2.2-r0 |
| Chainguard | rke2-runtime-1.34 | 1.34.2.2.1-r4 |
| Chainguard | rke2-runtime-1.34-charts | 1.34.2.2.1-r4 |
| Chainguard | rke2-runtime-1.35 | 1.35.6.2.1-r3 |
| Chainguard | rke2-runtime-1.36 | 1.36.2.2.1-r3 |
| Chainguard | rke2-runtime-fips-1.31 | no fix |
| Chainguard | rke2-runtime-fips-1.32 | no fix |
| Chainguard | skaffold | 2.17.0-r0 |
| Chainguard | skaffold-fips | 2.17.0-r0 |
| Chainguard | tekton-pipelines-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-controller-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-controller-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-controller-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-controller-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-controller-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-controller-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-controller-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-controller-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-controller-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-controller-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-controller-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-controller-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-entrypoint-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-entrypoint-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-entrypoint-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-entrypoint-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-entrypoint-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-entrypoint-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-events-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-events-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-events-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-events-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-events-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-events-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-events-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-events-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-events-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-events-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-events-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-events-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-nop-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-nop-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-nop-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-nop-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-nop-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-nop-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-nop-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-nop-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-nop-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-nop-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-nop-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-nop-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-resolvers-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-resolvers-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-resolvers-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-resolvers-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-resolvers-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-resolvers-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-resolvers-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-resolvers-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-resolvers-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-resolvers-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-resolvers-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-resolvers-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-webhook-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-webhook-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-webhook-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-webhook-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-webhook-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-webhook-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-webhook-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-webhook-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-webhook-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-webhook-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-webhook-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-webhook-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-workingdirinit-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-workingdirinit-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-workingdirinit-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-workingdirinit-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-workingdirinit-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-workingdirinit-0.65-compat | 0.65.7-r6 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.59 | 0.59.6-r6 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.59-compat | 0.59.6-r6 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.62 | 0.62.9-r6 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.62-compat | 0.62.9-r6 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.65 | 0.65.7-r6 |
| Chainguard | tekton-pipelines-workingdirinit-fips-0.65-compat | 0.65.7-r6 |
| Chainguard | telegraf-1.33 | 1.33.3-r15 |
| Chainguard | traefik-2.11 | 2.11.30-r0 |
| Chainguard | traefik-3.3 | no fix |
| Chainguard | traefik-3.4 | no fix |
| Chainguard | traefik-3.5 | 3.5.6-r1 |
| Chainguard | traefik-fips-2.11 | 2.11.30-r0 |
| Chainguard | traefik-fips-3.5 | 3.5.6-r0 |
| Chainguard | undock | 0.11.0-r0 |
| Chainguard | vault-1.16 | 1.16.3-r44 |
| Chainguard | vault-1.17 | no fix |
| Chainguard | vault-1.18 | 1.18.5-r14 |
| Chainguard | vault-1.18-compat | 1.18.5-r14 |
| Chainguard | vault-1.19 | 1.19.5-r4 |
| Chainguard | vault-1.19-compat | 1.19.5-r4 |
| Chainguard | vault-fips-1.18 | 1.18.5-r16 |
| Chainguard | vault-fips-1.18-compat | 1.18.5-r16 |
| Chainguard | vault-fips-1.19 | 1.19.5-r6 |
| Chainguard | vault-fips-1.19-compat | 1.19.5-r6 |
| Chainguard | xeol | 0.10.8-r11 |
| Chainguard | xeol-compat | 0.10.8-r11 |
| Chainguard | xeol-fips | 0.10.8-r12 |
| Debian 12 | docker.io | no fix |
| Debian 13 | docker.io | no fix |
| Debian 14 | docker.io | no fix |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250814T182633-150000.1.98.1 |
| Ubuntu 25.10 | docker.io | no fix |
| Ubuntu 26.04 LTS | docker.io | no fix |
| Ubuntu 26.10 | docker.io | no fix |
| Ubuntu Pro 16.04 LTS | docker.io | no fix |
| Ubuntu Pro 18.04 LTS | docker.io | no fix |
| Ubuntu Pro 20.04 LTS | docker.io | no fix |
| Ubuntu Pro 20.04 LTS | docker.io-app | no fix |
| Ubuntu Pro 22.04 LTS | docker.io | no fix |
| Ubuntu Pro 22.04 LTS | docker.io-app | no fix |
| Ubuntu Pro 24.04 LTS | docker.io | no fix |
| Ubuntu Pro 24.04 LTS | docker.io-app | no fix |
| Wolfi | aactl | 0.4.12-r35 |
| Wolfi | aactl | 0.4.12-r39 |
| Wolfi | amazon-cloudwatch-agent-operator | 3.3.1-r0 |
| Wolfi | bento | 1.10.0-r1 |
| Wolfi | bento-compat | 1.10.0-r1 |
| Wolfi | bom | 0.6.0-r24 |
| Wolfi | cluster-api-helm-controller | 0.3.2-r4 |
| Wolfi | cluster-api-helm-controller-compat | 0.3.2-r4 |
| Wolfi | crossplane-crank | 2.0.2-r1 |
| Wolfi | ctop | 0.7.7-r38 |
| Wolfi | docker-credential-gcr | 2.1.30-r3 |
| Wolfi | falco | 0.42.0-r0 |
| Wolfi | falco-dev | 0.42.0-r0 |
| Wolfi | falco-src | 0.42.0-r0 |
| Wolfi | falcoctl | 0.11.2-r5 |
| Wolfi | gatekeeper-3.19 | 3.19.3-r3 |
| Wolfi | gatekeeper-3.19-compat | 3.19.3-r3 |
| Wolfi | gatekeeper-3.19-crds | 3.19.3-r3 |
| Wolfi | gatekeeper-3.19-crds-compat | 3.19.3-r3 |
| Wolfi | gatekeeper-3.19-gator | 3.19.3-r3 |
| Wolfi | gitlab-docker-machine-18.6 | no fix |
| Wolfi | gitness | no fix |
| Wolfi | harbor-scanner-trivy | 0.33.2-r2 |
| Wolfi | helm-mapkubeapis | 0.6.1-r2 |
| Wolfi | helm-set-status | 0.3.0-r2 |
| Wolfi | k3d | 5.8.3-r16 |
| Wolfi | k3d-proxy | 5.8.3-r16 |
| Wolfi | k3d-tools | 5.8.3-r16 |
| Wolfi | k3s | 1.36.1.1-r0 |
| Wolfi | k3s-1.32 | 1.32.13.1-r2 |
| Wolfi | k3s-1.33 | 1.33.10.1-r5 |
| Wolfi | k3s-1.34 | 1.34.8.1-r0 |
| Wolfi | k3s-1.35 | 1.35.3.1-r8 |
| Wolfi | k3s-multicall | 1.34.1.1-r2 |
| Wolfi | k3s-multicall-1.32 | 1.32.9.1-r2 |
| Wolfi | k3s-multicall-1.33 | 1.33.5.1-r2 |
| Wolfi | k3s-static | 1.36.1.1-r0 |
| Wolfi | k3s-static-1.32 | 1.32.13.1-r2 |
| Wolfi | k3s-static-1.33 | 1.33.10.1-r5 |
| Wolfi | k3s-static-1.34 | 1.34.8.1-r0 |
| Wolfi | k3s-static-1.35 | 1.35.3.1-r8 |
| Wolfi | katib-controller | 0.18.0-r8 |
| Wolfi | katib-controller-compat | 0.18.0-r8 |
| Wolfi | katib-db-manager | 0.18.0-r8 |
| Wolfi | katib-db-manager-compat | 0.18.0-r8 |
| Wolfi | katib-earlystopping | 0.18.0-r8 |
| Wolfi | katib-file-metricscollector | 0.18.0-r8 |
| Wolfi | katib-file-metricscollector-compat | 0.18.0-r8 |
| Wolfi | katib-suggestion-goptuna | 0.18.0-r8 |
| Wolfi | katib-suggestion-goptuna-compat | 0.18.0-r8 |
| Wolfi | katib-suggestion-hyperband | 0.18.0-r8 |
| Wolfi | katib-suggestion-hyperopt | 0.18.0-r8 |
| Wolfi | katib-suggestion-nas-darts | 0.18.0-r8 |
| Wolfi | katib-suggestion-nas-enas | 0.18.0-r8 |
| Wolfi | katib-suggestion-optuna-enas | 0.18.0-r8 |
| Wolfi | katib-suggestion-pbt-enas | 0.18.0-r8 |
| Wolfi | katib-suggestion-skopt-enas | 0.18.0-r8 |
| Wolfi | katib-tfevent-metricscollector | 0.18.0-r8 |
| Wolfi | kpt | 1.0.0_beta55-r11 |
| Wolfi | kube-arangodb | 1.3.0-r2 |
| Wolfi | kube-arangodb-compat | 1.3.0-r2 |
| Wolfi | kubeflow-katib | 0.18.0-r8 |
| Wolfi | lazydocker | 0.24.1-r6 |
| Wolfi | newrelic-infrastructure-agent | 1.66.1-r1 |
| Wolfi | openbao | 2.4.3-r0 |
| Wolfi | opentelemetry-operator | 0.131.0-r1 |
| Wolfi | opentelemetry-operator-compat | 0.131.0-r1 |
| Wolfi | opentelemetry-operator-otel-allocator | 0.131.0-r1 |
| Wolfi | opentelemetry-operator-otel-allocator-compat | 0.131.0-r1 |
| Wolfi | portieris | 0.13.30-r1 |
| Wolfi | portieris-compat | 0.13.30-r1 |
| Wolfi | prometheus-3.2 | 3.2.1-r48 |
| Wolfi | promxy | 0.0.94-r0 |
| Wolfi | rancher-2.12 | 2.12.1-r0 |
| Wolfi | rancher-agent-2.13 | 2.13.0-r1 |
| Wolfi | rancher-machine | 0.15.0.144-r0 |
| Wolfi | skaffold | 2.17.0-r0 |
| Wolfi | traefik-3.3 | no fix |
| Wolfi | traefik-3.4 | no fix |
| Wolfi | undock | 0.11.0-r0 |
| Wolfi | xeol | 0.10.8-r11 |
| Wolfi | xeol-compat | 0.10.8-r11 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250814T182633-150000.1.98.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251230T014957-150000.1.134.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250811T192933-1.1 |