Most recent entries from all

bdu:2025-16113

BELL-CVE-2025-64329

Affected: Alpaquita:23: containerd, Alpaquita:25: containerd, Alpaquita:stream: containerd

certfr-2025-avi-1036 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-1036

Withdrawn: CLEANSTART-2026-CD03295 — Security fixes in rancher-agent 2.11.15-r1

Withdrawn by the publisher.

Affected: CleanStart: rancher-agent

Package rancher-agent version 2.11.15-r1 fixes 28 vulnerabilities: CVE-2026-53492, CVE-2026-50195, CVE-2026-53489, CVE-2024-40635, CVE-2024-25621...

EUVD-2026-260378

fkie_cve-2025-64329

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

GHSA-m6hq-p25p-ffr2 — containerd CRI server: Host memory exhaustion through Attach goroutine leak

Affected: Go: github.com/containerd/containerd, Go: github.com/containerd/containerd/v2

### Impact

A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd.

### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0 * 2.1.5 * 2.0.7 * 1.7.29

Users should update to these versions to resolve the issue.

### Workarounds

Set up an admission controller to control accesses to `pods/attach` resources. e.g., [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).

### Credits

The containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).

### References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)

msrc_CVE-2025-64329 — containerd CRI server: Host memory exhaustion through Attach goroutine leak

msrc_CVE-2025-64329

OESA-2025-2752 — containerd security update

Affected: openEuler:22.03-LTS-SP4: containerd

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc. Security Fix(es):

An overly broad default permission vulnerability was found in containerd.

- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store - `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700 - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host. - `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration. When the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.(CVE-2024-25621)

A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. Repetitive…

openSUSE-SU-2025:15726-1 — containerd-1.7.29-1.1 on GA media

containerd-1.7.29-1.1 on GA media

RHSA-2026:2900 — Red Hat Security Advisory: Network Observability 1.11.0 for OpenShift

github.com/containerd/containerd: containerd local privilege escalation node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications lodash: prototype pollution in _.unset and _.omit functions qs: qs: Denial of Service via improper input validation in array parsing runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects golang: archive/tar: Unbounded allocation when parsing GNU sparse map github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks node-forge: node-forge ASN.1 Unbounded Recursion urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check

SUSE-SU-2025:21042-1 — Security update for containerd

Security update for containerd

UBUNTU-CVE-2025-64329

Affected: Ubuntu:Pro:16.04:LTS: containerd, Ubuntu:Pro:18.04:LTS: containerd, Ubuntu:Pro:20.04:LTS: containerd, Ubuntu:Pro:20.04:LTS: containerd-app, Ubuntu:22.04:LTS: containerd, Ubuntu:Pro:22.04:LTS: containerd-app, Ubuntu:24.04:LTS: containerd-app, Ubuntu:Pro:24.04:LTS: containerd, Ubuntu:25.10: containerd, Ubuntu:25.10: containerd-app

WID-SEC-W-2025-2563 — Microsoft Azure Linux: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure Linux und Microsoft Windows ausnutzen um erhöhte Privilegien zu erlangen, beliebigen Code auszuführen, die Authentifizierung zu umgehen, Spoofing-Angriffe durchzuführen, einen Denial-of-Service-Zustand zu verursachen oder andere, nicht näher spezifizierte Angriffe durchzuführen.