UpHeron
All vulnerabilities

Servers and applications

CVE-2025-64329

Host memory exhaustion through goroutine leaks of Attach functionality in CRI server

Severity
Medium 6.9
Published
6 Nov 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.7.29, 2.0.7, 2.1.5
Also known as
GHSA-m6hq-p25p-ffr2
Sources
NVD, Project advisories (GitHub)

Description

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up…

Affected software

SoftwareAffected versions
containerdServers and applications · cpe:a:linuxfoundation:containerd
  • Version 2.2.0-rc1
  • Version 2.2.0-rc0
  • Version 2.2.0-beta2
  • Version 2.2.0-beta1
All 8 release lines
  • Every version before 1.7.29
  • From 2.0.0 before 2.0.7
  • From 2.1.0 before 2.1.5
  • Version 2.2.0-beta0
  • Version 2.2.0-beta1
  • Version 2.2.0-beta2
  • Version 2.2.0-rc0
  • Version 2.2.0-rc1
containerdServers and applications · github:containerd/containerd
  • Every version before 1.7.29

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-64329
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64329
  • GitHub Advisory Database https://github.com/advisories/GHSA-m6hq-p25p-ffr2
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2