containerd CRI server: Host memory exhaustion through Attach goroutine leak
Priority LOW 30CWE-401Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 45 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-401.
Summary
containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Partial containerd (containerd): 1.7.29, 2.0.7, 2.1.5 +1github.com/containerd/containerd (Go): 1.7.29+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 45 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | containerd | before 1.7.29; before 2.0.7; 2.1.0-beta.0 to before 2.1.5; 2.2.0-beta.0 to before 2.2.0 | 1.7.29, 2.0.7, 2.1.5, 2.2.0 | Patch available | CNA |
| — | github.com/containerd/containerd (Go) | before 1.7.29 | 1.7.29 | Patch available | GHSA-m6hq-p25p-ffr2 |
| — | github.com/containerd/containerd/v2 (Go) | before 2.0.7 | 2.0.7 | Patch available | GHSA-m6hq-p25p-ffr2 |
| — | github.com/containerd/containerd/v2 (Go) | 2.1.0-beta.0 to before 2.1.5 | 2.1.5 | Patch available | GHSA-m6hq-p25p-ffr2 |
| — | github.com/containerd/containerd/v2 (Go) | 2.2.0-beta.0 to before 2.2.0 | 2.2.0 | Patch available | GHSA-m6hq-p25p-ffr2 |
- containerd Vendorbackstage Affected before 1.7.29; before 2.0.7; 2.1.0-beta.0 to before 2.1.5; 2.2.0-beta.0 to before 2.2.0 Fixed in 1.7.29, 2.0.7, 2.1.5, 2.2.0 Patch available CNA
- github.com/containerd/containerd (Go) Vendor— Affected before 1.7.29 Fixed in 1.7.29 Patch available GHSA-m6hq-p25p-ffr2
- github.com/containerd/containerd/v2 (Go) Vendor— Affected before 2.0.7 Fixed in 2.0.7 Patch available GHSA-m6hq-p25p-ffr2
- github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.1.0-beta.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-m6hq-p25p-ffr2
- github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.2.0-beta.0 to before 2.2.0 Fixed in 2.2.0 Patch available GHSA-m6hq-p25p-ffr2
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* | before 1.7.29; 2.0.0 to before 2.0.7; 2.1.0 to before 2.1.5 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta0:*:*:*:*:*:* | 2.2.0 beta0 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta1:*:*:*:*:*:* | 2.2.0 beta1 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta2:*:*:*:*:*:* | 2.2.0 beta2 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc0:*:*:*:*:*:* | 2.2.0 rc0 | Vulnerable | backstage |
| cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc1:*:*:*:*:*:* | 2.2.0 rc1 | Vulnerable | backstage |
- cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions before 1.7.29; 2.0.0 to before 2.0.7; 2.1.0 to before 2.1.5 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta0:*:*:*:*:*:* Versions 2.2.0 beta0 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta1:*:*:*:*:*:* Versions 2.2.0 beta1 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:containerd:2.2.0:beta2:*:*:*:*:*:* Versions 2.2.0 beta2 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc0:*:*:*:*:*:* Versions 2.2.0 rc0 Vulnerable ·backstage
- cpe:2.3:a:linuxfoundation:containerd:2.2.0:rc1:*:*:*:*:*:* Versions 2.2.0 rc1 Vulnerable ·backstage
Remediation
- Fix · CNA containerd (containerd) Fixed in 1.7.29, 2.0.7, 2.1.5, 2.2.0
- Fix · GHSA-m6hq-p25p-ffr2 github.com/containerd/containerd (Go) Fixed in 1.7.29 Advisory →
- Fix · GHSA-m6hq-p25p-ffr2 github.com/containerd/containerd/v2 (Go) Fixed in 2.0.7 Advisory →
- Fix · GHSA-m6hq-p25p-ffr2 github.com/containerd/containerd/v2 (Go) Fixed in 2.1.5 Advisory →
- Fix · GHSA-m6hq-p25p-ffr2 github.com/containerd/containerd/v2 (Go) Fixed in 2.2.0 Advisory →
Red Hat 2 advisories
- RHSA-2026:37387 Released 2026-07-09 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
- RHSA-2026:2900 Released 2026-02-18 · Red Hat rating ImportantNetwork Observability 1.11.0 for OpenShift
- Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet |
| Compliance Operator | Affected | No fix yet |
| Confidential Compute Attestation | Affected | No fix yet |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet |
| Deployment Validation Operator | Affected | No fix yet |
| File Integrity Operator | Affected | No fix yet |
| Gatekeeper 3 | Affected | No fix yet |
| Kernel Module Management Operator for Red Hat Openshift | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Logical Volume Manager Storage | Affected | No fix yet |
| Machine Deletion Remediation Operator | Affected | No fix yet |
| Migration Toolkit for Containers | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Multicluster Engine for Kubernetes | Affected | No fix yet |
| Multicluster Global Hub | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift API for Data Protection | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| OpenShift Service Mesh 3 | Affected | No fix yet |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Kueue | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift for Windows Containers | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Red Hat Web Terminal | Affected | No fix yet |
| Network Observability (NETOBSERV) 1.11.0 | Fixed | RHSA-2026:2900 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:37387 |
Not affected: 4 products
- Network Observability (NETOBSERV) 1.11.0
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift GitOps
- Red Hat Openshift Data Foundation 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64329
- 2026-10-03 Alias added: GHSA-m6hq-p25p-ffr2
- 2026-11-05 Affected versions changed · Red Hat
References
More backstage Containerd vulnerabilities
- TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
- TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
- TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
- TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
- TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
- TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
Sources
- CVE-2025-64329 · CVE Program
- CVE-2025-64329 · NVD
- FIRST EPSS
- GHSA-m6hq-p25p-ffr2 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-64329 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences