CVE-2025-64329: containerd CRI server: Host memory exhaustion through Attach goroutine leak

Analyzed

AliasesUBUNTU-CVE-2025-64329DEBIAN-CVE-2025-64329CGA-256p-xqrr-v3m2+541 more

Published 07-11-2025Last modified 07-11-2025

Vulnerability summary

CVE-2025-64329 is a medium (CVSS 6.9) vulnerability in containerd. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.9, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.17%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

07-11-2025
PublishedVulnerability first disclosed.
07-11-2025
Last modifiedVulnerability information updated.

Description

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

CVSS metrics

9 scores · 7 sources · 2 versions

v4.06.9v3.15.5

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected systems

Version check

Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

amazon-ecs-agent-fips< 1.100.1-r2
apm-server-7.17< 7.17.29-r5
apm-server-7.17-compat< 7.17.29-r5
apm-server-fips-7.17< 7.17.29-r5
apm-server-fips-7.17-compat< 7.17.29-r5

auditbeat-7< 7.17.29-r5
auditbeat-fips-7< 7.17.29-r6
beats-fips-7< 7.17.29-r6
buildctl< 0.25.2-r2
buildkitd< 0.25.2-r2
cert-manager-cmctl< 2.3.0-r6
cert-manager-cmctl-fips< 2.3.0-r6
cg< 0.2.174-r0
chainctl< 0.2.175-r0
chartmuseum< 0.16.3-r9
chartmuseum-fips< 0.16.3-r7
cilium-cli< 0.18.8-r1
cloudbeat-8.17< 8.17.10-r3
cloudbeat-8.18< 8.18.8-r3
cloudbeat-8.19< 8.19.6-r2
cloudbeat-9.0< 9.0.8-r3
cloudbeat-9.1< 9.1.6-r2
cloudbeat-fips-8.17< 8.17.10-r4
cloudbeat-fips-8.18< 8.18.8-r3
cloudbeat-fips-8.19< 8.19.6-r2
cloudbeat-fips-9.0< 9.0.8-r3
cloudbeat-fips-9.1< 9.1.6-r2
cloudbeat-fips-9.2< 9.2.0-r2
cluster-api-helm-controller< 0.4.1-r2
cluster-api-helm-controller-compat< 0.4.1-r2
cluster-api-helm-controller-fips< 0.4.1-r2
cluster-api-helm-controller-fips-compat< 0.4.1-r2
consul-k8s-1.1< 1.1.18-r20
consul-k8s-1.1-cli< 1.1.18-r20
consul-k8s-1.3< 1.3.9-r21
consul-k8s-1.3-cli< 1.3.9-r21
consul-k8s-1.4-cli< 1.4.10-r8
consul-k8s-1.5< 1.5.9-r7
consul-k8s-1.5-cli< 1.5.9-r7
consul-k8s-1.6-cli< 1.6.10-r2
consul-k8s-1.7-cli< 1.7.7-r1
consul-k8s-fips-1.1-cli< 1.1.18-r18
consul-k8s-fips-1.3< 1.3.9-r19
consul-k8s-fips-1.3-cli< 1.3.9-r19
consul-k8s-fips-1.4< 1.4.10-r7
consul-k8s-fips-1.4-cli< 1.4.10-r7
consul-k8s-fips-1.5-cli< 1.5.9-r7
consul-k8s-fips-1.6-cli< 1.6.10-r2
consul-k8s-fips-1.7< 1.7.7-r1
consul-k8s-fips-1.7-cli< 1.7.7-r1
containerd-1< 1.7.29-r0
containerd-shim-runc-v2-1< 1.7.29-r1 | < 1.7.29-r0
containerd-stress-1< 1.7.29-r1
ctop< 0.7.7-r34
ctr-1< 1.7.29-r0
dagger< 0.19.6-r0
datadog-agent-7.71< 7.71.2-r6 | < 7.71.2-r5
datadog-agent-7.71-core-integrations< 7.71.2-r5
datadog-agent-7.71-fakeintake< 7.71.2-r5
datadog-agent-7.71-jmx< 7.71.2-r5
datadog-agent-7.71-oci-compat< 7.71.2-r5
datadog-agent-7.71-s6-overlay< 7.71.2-r5
datadog-agent-fips-7.71< 7.71.2-r4
datadog-agent-fips-7.71-core-integrations< 7.71.2-r4
datadog-agent-fips-7.71-fakeintake< 7.71.2-r4
datadog-agent-fips-7.71-jmx< 7.71.2-r4
datadog-agent-fips-7.71-oci-compat< 7.71.2-r4
datadog-agent-fips-7.71-s6-overlay< 7.71.2-r4
datadog-cluster-agent-7.71< 7.71.2-r5
datadog-cluster-agent-7.71-oci-compat< 7.71.2-r5
datadog-cluster-agent-fips-7.71< 7.71.2-r4
datadog-cluster-agent-fips-7.71-oci-compat< 7.71.2-r4
docker-cli-buildx< 0.29.1-r2
docker-cli-buildx-fips< 0.29.1-r2
docker-compose< 2.40.3-r1
docker-credential-cgr< 0.2.175-r0
dockerd< 28.5.2-r3
dogstatsd-7.71< 7.71.2-r5
eksctl< 0.216.0-r1
envoy-gateway-egctl< 1.5.4-r1
falco-no-driver< 0.43.0-r0
filebeat-fips-7< 7.17.29-r6
flux-helm-controller< 1.4.3-r1
flux-helm-controller-iamguarded-compat< 1.4.3-r1
flux-source-controller< 1.7.3-r1
flux-source-controller-fips< 1.7.3-r2
flux-source-controller-iamguarded-compat< 1.7.3-r1
fuse-overlayfs-snapshotter< 2.1.7-r0
gatekeeper-3.19-compat< 3.19.3-r8
gatekeeper-3.19-gator< 3.19.3-r8
gatekeeper-3.20< 3.20.1-r3
gatekeeper-3.20-compat< 3.20.1-r3
gatekeeper-3.20-crds< 3.20.1-r3
gatekeeper-3.20-crds-compat< 3.20.1-r3
gatekeeper-3.20-gator< 3.20.1-r3
gem-check< 0.0.32-r1
gitlab-operator< 2.5.1-r1
gitlab-operator-fips< 2.5.1-r1
gitlab-rails-ce-18.1< 18.1.6-r3
gitlab-rails-ce-18.2< 18.2.8-r3 | < 18.2.8-r1
gitlab-rails-ce-18.3< 18.3.5-r1
gitlab-rails-ce-18.4< 18.4.3-r1
gitlab-rails-ce-18.5< 18.5.1-r1
gitlab-rails-ce-assets-18.1< 18.1.6-r3
gitlab-rails-ce-assets-18.3< 18.3.5-r1
gitlab-rails-ce-assets-18.4< 18.4.3-r1
gitlab-rails-ce-assets-18.5< 18.5.1-r1
gitlab-rails-ce-assets-fips-18.2< 18.2.8-r4
gitlab-rails-ce-assets-fips-18.3< 18.3.5-r3
gitlab-rails-ce-assets-fips-18.5< 18.5.1-r3
gitlab-rails-ce-doc-18.1< 18.1.6-r3
gitlab-rails-ce-doc-18.3< 18.3.5-r1
gitlab-rails-ce-doc-18.4< 18.4.3-r1
gitlab-rails-ce-doc-18.5< 18.5.1-r1
gitlab-rails-ce-doc-fips-18.2< 18.2.8-r4
gitlab-rails-ce-doc-fips-18.5< 18.5.1-r3
gitlab-rails-ce-fips-18.1< 18.1.6-r2 | < 18.1.6-r7
gitlab-rails-ce-fips-18.2< 18.2.8-r4
gitlab-rails-ce-fips-18.3< 18.3.5-r3
gitlab-rails-ce-fips-18.4< 18.4.3-r3
gitlab-rails-ce-fips-18.5< 18.5.1-r3
gogatekeeper< 4.3.0-r1
google-osconfig-agent< 20251028.00-r2
gosh< 0.0.32-r1
grype< 0.103.0-r1
header-check< 0.0.32-r1
headlamp< 0.37.0-r1
headlamp-fips< 0.37.0-r2
headlamp-fips-compat< 0.37.0-r2
heartbeat-7< 7.17.29-r5
heartbeat-fips-7< 7.17.29-r6
heartbeat-fips-7-oci-entrypoint< 7.17.29-r6
helm< 3.19.0-r2
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
helm-diff< 3.13.1-r2
helm-diff-fips< 3.13.1-r2
helm-fips< 3.19.0-r3
helm-fips-3< 3.19.2-r0
helm-fips-4< 4.0.1-r1
helm-mapkubeapis< 0.6.1-r5
helm-operator< 1.41.1-r6
helm-operator-compat< 1.41.1-r6
helm-operator-fips< 1.41.1-r6
helm-operator-fips-compat< 1.41.1-r6
helm-push< 0.10.4-r36
helm-set-status< 0.3.0-r6
help-check< 0.0.32-r1
k3s< 1.34.1.1-r3
k3s-1.31All versions (No fix recorded)
k3s-1.32All versions (No fix recorded)
k3s-1.33All versions (No fix recorded)
k3s-multicall< 1.34.1.1-r3
k3s-multicall-1.32All versions (No fix recorded)
k3s-multicall-1.33All versions (No fix recorded)
k3s-static< 1.34.1.1-r3
k3s-static-1.31All versions (No fix recorded)
k3s-static-1.32All versions (No fix recorded)
k3s-static-1.33All versions (No fix recorded)
k8sgpt< 0.4.26-r1
k8ssandra-client< 0.8.3-r2
k8ssandra-client-compat< 0.8.3-r2
k8ssandra-client-fips< 0.8.3-r3
k9s< 0.50.16-r2
k9s-fips< 0.50.16-r3
kaniko< 1.25.4-r0 | < 1.25.3-r3
kaniko-compat< 1.25.3-r3
kaniko-fips< 1.24.0-r8
kaniko-warmer< 1.25.4-r0 | < 1.25.3-r3
kaniko-warmer-fips< 1.24.0-r8
kargo< 1.8.3-r1
kargo-oci-compat< 1.8.3-r1
kots< 1.128.3-r1
kots-compat< 1.128.3-r1
kots-symlink-compat< 1.128.3-r1
kube-arangodb-1.3< 1.3.1-r2
kube-arangodb-1.3-compat< 1.3.1-r2
kube-arangodb-fips-1.3< 1.3.1-r2
kubescape< 3.0.44-r0
kubescape-operator< 0.2.112-r0
kubevela< 1.10.4-r3
kubevela-vela-cli< 1.10.4-r3
kubevela-vela-core< 1.10.4-r3
kubevela-vela-core-compat< 1.10.4-r3
kubevela-vela-core-fips< 1.10.4-r3
ldd-check< 0.0.32-r1
livekit-cli< 2.12.8-r1
manifest-tool< 2.2.1-r2
melange< 0.32.0-r2
metricbeat-fips-7< 7.17.29-r6
nerdctl< 2.2.0-r0
nerdctl-fips< 2.2.0-r0
neuvector-controller< 5.4.7-r1
neuvector-enforcer< 5.4.7-r1
neuvector-scanner< 3.974-r1
neuvector-scanner-fips< 3.974-r1
neuvector-scanner-monitor< 3.974-r1
neuvector-scanner-task< 3.974-r1
neuvector-scanner-task-fips< 3.974-r1
neuvector-upgrader< 5.4.7-r1

Show all 200

1 vendor · 200 products · Showing 200 of 363

References

9 links

github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2X Refsource CONFIRMREPORTAdvisoryWEBPatchVendor Advisory
github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612dfX Refsource MISCREPORTFIXWEBPatch
ubuntu.com/security/CVE-2025-64329REPORT
www.cve.org/CVERecord?id=CVE-2025-64329REPORT
ubuntu.com/security/notices/USN-7983-1Advisory
security-tracker.debian.org/tracker/CVE-2025-64329Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64329.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-64329AdvisoryOval
github.com/containerd/containerdPACKAGE