TI-2025-03955 Aliases CVE-2025-4437 GHSA-8f93-j3fx-72f3

Cri-o: large /etc/passwd file may lead to denial of service

LOW 25CWE-770Published 2025-08-20 · Updated 2026-09-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00248 16th percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Red Hat	Red Hat OpenShift Container Platform 4	—	—	No fix listed	CNA
Red Hat	Red Hat OpenShift Container Platform 4	—	—	No fix listed	CNA
Red Hat	Red Hat OpenShift Container Platform 4	—	—	No fix listed	CNA
—	github.com/cri-o/cri-o (Go)	up to 1.33.3	—	No fix listed	GHSA-8f93-j3fx-72f3

Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
github.com/cri-o/cri-o (Go) Vendor— Affected up to 1.33.3 Fixed in — No fix listed GHSA-8f93-j3fx-72f3

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:/a:redhat:openshift:4	4	—	Red Hat

cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-4437
2026-10-03 Alias added: GHSA-8f93-j3fx-72f3

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-4437

Other 4

TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8

See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences