CVE-2025-64329CWE-401

containerd CRI server: Host memory exhaustion through Attach goroutine leak

Medium · published November 7, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00171 · 6.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2025-11-07T04:15Z
EPSS history
Timeline
  • 07 NOV 04:15Z
    containerd CRI server: Host memory exhaustion through Attach goroutine leak
    cvelistv5