CVE-2025-64329 - CVE House

Back to Database

Status published Medium CVE-2025-64329

containerd CRI server: Host memory exhaustion through Attach goroutine leak

6.9 CVSS

Vulnerability Description

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64329

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from containerd

View All →

containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.

Containerd vulnerable to host filesystem access during image unpack

containerd has an integer overflow in User ID handling

containerd affected by a local privilege escalation via wide permissions on CRI directory

containerd supplementary groups are not set up properly

Affected Vendor

containerd

View all reports →

Affected Software

containerd

Vulnerable Versions:

< 1.7.29, < 2.0.7, >= 2.1.0-beta.0, < 2.1.5, >= 2.2.0-beta.0, < 2.2.0

Timeline

Official Publish: November 7th, 2025

Last Modified: November 7th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1486 Data Encrypted for Impact

T1562 Impair Defenses

Defense Evasion