CVE-2025-0426: kubernetes kubelet Uncontrolled Resource Consumption

CVSS: 6.2v3.1MediumDeferred

AliasesUBUNTU-CVE-2025-0426DEBIAN-CVE-2025-0426CGA-248j-pgj4-f2x5+443 more

Published 13-02-2025Last modified 13-02-2025

Vulnerability summary

CVE-2025-0426 is a medium (CVSS 6.2) Uncontrolled Resource Consumption vulnerability in kubernetes kubelet. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Overall risk

25/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.2/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.37%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

13-02-2025
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

CVSS metrics

7 scores · 7 sources · 1 version

v3.16.2

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

0.00 pp

From 0.37% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Chainguard200 products

argo-cd-2.11All versions (No fix recorded)
argo-cd-2.13< 2.13.5-r2
argo-cd-2.13-compat< 2.13.5-r2
argo-cd-2.13-repo-server< 2.13.5-r2
argo-cd-2.14< 2.14.2-r1

argo-cd-2.14-compat< 2.14.2-r1
argo-cd-2.14-repo-server< 2.14.2-r1
argo-cd-fips-2.14< 2.14.2-r1
argo-cd-fips-2.14-compat< 2.14.2-r1
argo-cd-fips-2.14-repo-server< 2.14.2-r1
argo-rollouts< 1.8.0-r2
argo-rollouts-fips< 1.8.0-r2
argocd-image-updater< 0.17.0-r1
argocd-image-updater-fips< 0.17.0-r2
aws-ebs-csi-driver< 1.39.0-r2
aws-efs-csi-driver< 2.1.7-r0
aws-efs-csi-driver-fips< 2.1.7-r0
azuredisk-csi-1.28< 1.28.12-r9
azuredisk-csi-1.29< 1.29.14-r9
azuredisk-csi-1.30< 1.30.7-r3
azuredisk-csi-1.30-compat< 1.30.7-r3
azuredisk-csi-1.31< 1.31.3-r1
azuredisk-csi-1.31-compat< 1.31.3-r1
azuredisk-csi-fips-1.28< 1.28.12-r8
azuredisk-csi-fips-1.29< 1.29.14-r8
azuredisk-csi-fips-1.30< 1.30.7-r3
azuredisk-csi-fips-1.31< 1.31.3-r1
calico-3.29< 3.29.2-r31
calico-apiserver-3.29< 3.29.2-r31
calico-apiserver-compat-3.29< 3.29.2-r31
calico-apiserver-fips-3.29< 3.29.2-r31
calico-app-policy-3.29< 3.29.2-r31
calico-app-policy-fips-3.29< 3.29.2-r31
calico-cni-3.29< 3.29.2-r31
calico-cni-compat-3.29< 3.29.2-r31
calico-cni-compat-fips-3.29< 3.29.2-r31
calico-cni-fips-3.29< 3.29.2-r31
calico-felix-3.29< 3.29.2-r31
calico-felix-fips-3.29< 3.29.2-r31
calico-fips-3.29< 3.29.2-r31
calico-key-cert-provisioner-3.29< 3.29.2-r31
calico-key-cert-provisioner-fips-3.29< 3.29.2-r31
calico-kube-controllers-3.29< 3.29.2-r31
calico-kube-controllers-fips-3.29< 3.29.2-r31
calico-node-3.29< 3.29.2-r31
calico-node-fips-3.29< 3.29.2-r31
calico-pod2daemon-3.29< 3.29.2-r31
calico-pod2daemon-fips-3.29< 3.29.2-r31
calico-pod2daemon-flexvol-compat-3.29< 3.29.2-r31
calico-typha-client-3.29< 3.29.2-r31
calico-typha-client-fips-3.29< 3.29.2-r31
calico-typhad-3.29< 3.29.2-r31
calico-typhad-fips-3.29< 3.29.2-r31
calicoctl-3.29< 3.29.2-r31
calicoctl-fips-3.29< 3.29.2-r31
cluster-autoscaler-1.31< 1.31.5-r1
cluster-autoscaler-1.32< 1.32.0-r3
cluster-autoscaler-1.32-compat< 1.32.0-r3
cluster-autoscaler-fips-1.31< 1.31.1-r5
cluster-autoscaler-fips-1.31-compat< 1.31.1-r5
cluster-autoscaler-fips-1.32< 1.32.0-r4
cluster-autoscaler-fips-1.32-compat< 1.32.0-r4
emissary< 3.10.0-r12
ip-masq-agent< 2.12.0-r5
kapp< 0.64.0-r4
kapp-fips< 0.64.0-r3
kube-apiserver-1.31< 1.31.6-r0
kube-apiserver-1.31-default< 1.31.6-r0
kube-apiserver-1.31-default-compat< 1.31.6-r0
kube-apiserver-1.32< 1.32.2-r0
kube-apiserver-1.32-default< 1.32.2-r0
kube-apiserver-1.32-default-compat< 1.32.2-r0
kube-apiserver-fips-1.31< 1.31.6-r1
kube-apiserver-fips-1.31-default< 1.31.6-r1
kube-apiserver-fips-1.31-default-compat< 1.31.6-r1
kube-apiserver-fips-1.32< 1.32.2-r1
kube-apiserver-fips-1.32-default< 1.32.2-r1
kube-apiserver-fips-1.32-default-compat< 1.32.2-r1
kube-controller-manager-1.31< 1.31.6-r0
kube-controller-manager-1.31-default< 1.31.6-r0
kube-controller-manager-1.31-default-compat< 1.31.6-r0
kube-controller-manager-1.32< 1.32.2-r0
kube-controller-manager-1.32-default< 1.32.2-r0
kube-controller-manager-1.32-default-compat< 1.32.2-r0
kube-controller-manager-fips-1.31< 1.31.6-r1
kube-controller-manager-fips-1.31-default< 1.31.6-r1
kube-controller-manager-fips-1.31-default-compat< 1.31.6-r1
kube-controller-manager-fips-1.32< 1.32.2-r1
kube-controller-manager-fips-1.32-default< 1.32.2-r1
kube-controller-manager-fips-1.32-default-compat< 1.32.2-r1
kube-proxy-1.31< 1.31.6-r0
kube-proxy-1.31-default< 1.31.6-r0
kube-proxy-1.31-default-compat< 1.31.6-r0
kube-proxy-1.32< 1.32.2-r0
kube-proxy-1.32-default< 1.32.2-r0
kube-proxy-1.32-default-compat< 1.32.2-r0
kube-proxy-fips-1.31< 1.31.6-r1
kube-proxy-fips-1.31-default< 1.31.6-r1
kube-proxy-fips-1.31-default-compat< 1.31.6-r1
kube-proxy-fips-1.32< 1.32.2-r1
kube-proxy-fips-1.32-default< 1.32.2-r1
kube-proxy-fips-1.32-default-compat< 1.32.2-r1
kube-scheduler-1.31< 1.31.6-r0
kube-scheduler-1.31-default< 1.31.6-r0
kube-scheduler-1.31-default-compat< 1.31.6-r0
kube-scheduler-1.32< 1.32.2-r0
kube-scheduler-1.32-default< 1.32.2-r0
kube-scheduler-1.32-default-compat< 1.32.2-r0
kube-scheduler-fips-1.31< 1.31.6-r1
kube-scheduler-fips-1.31-default< 1.31.6-r1
kube-scheduler-fips-1.31-default-compat< 1.31.6-r1
kube-scheduler-fips-1.32< 1.32.2-r1
kube-scheduler-fips-1.32-default< 1.32.2-r1
kube-scheduler-fips-1.32-default-compat< 1.32.2-r1
kubeadm-1.31< 1.31.6-r0
kubeadm-1.31-default< 1.31.6-r0
kubeadm-1.31-default-compat< 1.31.6-r0
kubeadm-1.32< 1.32.2-r0
kubeadm-1.32-default< 1.32.2-r0
kubeadm-1.32-default-compat< 1.32.2-r0
kubeadm-fips-1.31< 1.31.6-r1
kubeadm-fips-1.31-default< 1.31.6-r1
kubeadm-fips-1.31-default-compat< 1.31.6-r1
kubeadm-fips-1.32< 1.32.2-r1
kubeadm-fips-1.32-default< 1.32.2-r1
kubeadm-fips-1.32-default-compat< 1.32.2-r1
kubectl-1.27All versions (No fix recorded)
kubectl-1.27-defaultAll versions (No fix recorded) | < 1.27.11-r1
kubectl-1.28All versions (No fix recorded)
kubectl-1.28-defaultAll versions (No fix recorded) | < 1.28.7-r1
kubectl-1.30< 1.30.10-r0
kubectl-1.30-default< 1.30.10-r0
kubectl-1.31< 1.31.6-r0
kubectl-1.31-default< 1.31.6-r0
kubectl-1.31-default-compat< 1.31.6-r0
kubectl-1.31-iamguarded-compat< 1.31.6-r0
kubectl-1.32< 1.32.2-r0
kubectl-1.32-default< 1.32.2-r0
kubectl-1.32-default-compat< 1.32.2-r0
kubectl-1.32-iamguarded-compat< 1.32.2-r0
kubectl-argo-rollouts< 1.8.0-r2
kubectl-argo-rollouts-fips< 1.8.0-r2
kubectl-bash-completion-1.27All versions (No fix recorded)
kubectl-bash-completion-1.28All versions (No fix recorded)
kubectl-bash-completion-1.30< 1.30.10-r0
kubectl-bash-completion-1.31< 1.31.6-r0
kubectl-bash-completion-1.32< 1.32.2-r0
kubectl-bash-completion-fips-1.31< 1.31.6-r1
kubectl-bash-completion-fips-1.32< 1.32.2-r1
kubectl-fips-1.31< 1.31.6-r1
kubectl-fips-1.31-default< 1.31.6-r1
kubectl-fips-1.31-default-compat< 1.31.6-r1
kubectl-fips-1.32< 1.32.2-r1
kubectl-fips-1.32-default< 1.32.2-r1
kubectl-fips-1.32-default-compat< 1.32.2-r1
kubelet-1.31< 1.31.6-r0
kubelet-1.31-default< 1.31.6-r0
kubelet-1.31-default-compat< 1.31.6-r0
kubelet-1.32< 1.32.2-r0
kubelet-1.32-default< 1.32.2-r0
kubelet-1.32-default-compat< 1.32.2-r0
kubelet-fips-1.31< 1.31.6-r1
kubelet-fips-1.31-default< 1.31.6-r1
kubelet-fips-1.31-default-compat< 1.31.6-r1
kubelet-fips-1.32< 1.32.2-r1
kubelet-fips-1.32-default< 1.32.2-r1
kubelet-fips-1.32-default-compat< 1.32.2-r1
kubernetes-1.30< 1.30.10-r0
kubernetes-1.31< 1.31.6-r0
kubernetes-1.31-default< 1.31.6-r0
kubernetes-1.32< 1.32.2-r0
kubernetes-1.32-default< 1.32.2-r0
kubernetes-csi-driver-hostpath< 1.15.0-r6
kubernetes-csi-driver-nfs< 4.12.1-r1
kubernetes-csi-driver-nfs-fips< 4.11.0-r0
kubernetes-csi-driver-nfs-fips-compat< 4.11.0-r0
kubernetes-dns-node-cache< 1.25.0-r2
kubernetes-dns-node-cache-fips< 1.25.0-r2
kubernetes-fips-1.31< 1.31.6-r1
kubernetes-fips-1.31-default< 1.31.6-r1
kubernetes-fips-1.32< 1.32.2-r1
kubernetes-fips-1.32-default< 1.32.2-r1
kubernetes-pause-1.31< 1.31.6-r0
kubernetes-pause-1.32< 1.32.2-r0
kubernetes-pause-compat-1.31< 1.31.6-r0
kubernetes-pause-compat-1.32< 1.32.2-r0
local-static-provisioner< 2.7.0-r13
local-static-provisioner-compat< 2.7.0-r13
local-static-provisioner-fips< 2.7.0-r5
local-static-provisioner-fips-compat< 2.7.0-r5
local-volume-node-cleanup< 2.7.0-r13
local-volume-node-cleanup-compat< 2.7.0-r13
local-volume-node-cleanup-fips< 2.7.0-r5
local-volume-node-cleanup-fips-compat< 2.7.0-r5
node-feature-discovery-0.16< 0.16.7-r3
node-feature-discovery-0.17< 0.17.1-r3
nodetaint< 0.0.4-r28
rancher-agent-2.10< 2.10.2-r2
rancher-agent-2.11< 2.11.0-r1
rancher-agent-2.9< 2.9.12-r2

Show all 200

1 vendor · 200 products · Showing 200 of 267. Use Open JSON for the complete list.

References

16 links

github.com/kubernetes/kubernetes/issues/130016Issue TrackingREPORTWEB
groups.google.com/g/kubernetes-security-announce/c/KiODfu8i6w8Mailing ListREPORTARTICLEWEB
www.openwall.com/lists/oss-security/2025/02/13/1REPORTWEB
ubuntu.com/security/CVE-2025-0426REPORT
www.cve.org/CVERecord?id=CVE-2025-0426REPORT
github.com/kubernetes/kubernetes/pull/130014REPORT
security-tracker.debian.org/tracker/CVE-2025-0426Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0426.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-0426AdvisoryOval
github.com/kubernetes/kubernetesPACKAGE

Show all 16 references

github.com/advisories/GHSA-jgfp-53c3-624wAdvisory
lists.opensuse.org/archives/…Advisory
www.suse.com/security/cve/CVE-2025-0426WEB
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities