CVE-2025-47291 - CVE House
Back to Database
Status published Medium CVE-2025-47291

containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.

Vulnerability Description

containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. As a workaround, disable usernamespaced pods in Kubernetes temporarily.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-47291

Credits & Attribution

No credits recorded in the NVD database.

References

More from containerd

View All →
CVE-2025-64329
containerd CRI server: Host memory exhaustion through Attach goroutine leak
Medium 6.9
CVE-2025-47290
Containerd vulnerable to host filesystem access during image unpack
High 7.6
CVE-2024-40635
containerd has an integer overflow in User ID handling
Medium 4.6
CVE-2024-25621
containerd affected by a local privilege escalation via wide permissions on CRI directory
High 7.3
CVE-2023-25173
containerd supplementary groups are not set up properly
Medium 5.3

Affected Vendor

Affected Software

containerd
Vulnerable Versions:
>= 2.0.1, < 2.0.5

Timeline

Official Publish: May 21st, 2025
Last Modified: May 21st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-266

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1484 Domain or Tenant Policy Modification
Defense Evasion
T1021 Remote Services
Lateral Movement