Bug 2413299 (CVE-2025-64329)

Summary:	CVE-2025-64329 github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, akoudelk, alcohan, amctagga, anjoseph, anpicker, aoconnor, aprice, bbrownin, bdettelb, bniver, bparees, carogers, caswilli, crizzo, dfreiber, dhanak, doconnor, drosa, drow, dsimansk, dymurray, eglynn, erezende, fdeutsch, flucifre, gmeno, gparvin, groman, haoli, hasun, hkataria, ibolton, jajackso, jbalunas, jburrell, jcammara, jcantril, jfula, jjoyce, jkoehler, jmatthew, jmitchel, jmontleo, jneedle, jowilson, jprabhak, jsamir, jschluet, kaycoth, kegrant, kingland, koliveir, kshier, kverlaen, lball, lbragsta, lgamliel, lhh, ljawale, lphiri, lsvaty, luizcosta, mabashia, manissin, matzew, mbenjamin, mburns, mgarciac, mhackett, mnovotny, ngough, nweather, nyancey, oezr, ometelka, oramraz, owatkins, pahickey, pakotvan, pbraun, pgaikwad, pgrist, ptisnovs, rbobbitt, rfreiman, rhaigner, rjohnson, rojacob, sakbas, sausingh, sdawley, shvarugh, simaishi, slucidi, smcdonal, smullick, sostapov, sseago, stcannon, sthirugn, stirabos, syedriko, teagle, tfister, thason, thavo, vereddy, veshanka, vkumar, wenshen, whayutin, wtam, xdharmai, xiyuan, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in containerd. This vulnerability allows a user to exhaust memory on the host due to goroutine leaks via a bug in the CRI (Container Runtime Interface) Attach implementation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-11-07 05:01:34 UTC

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.