CVE-2025-64329 containerd CRI server: Host memory exhaustion through Attach goroutine leak
Attackers can exhaust host memory via goroutine leaks in containerd's CRI Attach implementation, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64329?
CVE-2025-64329 is a medium-severity denial of service vulnerability in containerd, published on 7 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.
Weakness: CWE-401
Which versions are affected by CVE-2025-64329?
10 open source packages ship an affected version, including github.com/containerd/containerd/v2 and github.com/containerd/containerd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containerd/containerd/v2 Go | All versions | 2.0.7, 2.1.5, 2.2.0 |
github.com/containerd/containerd/v2 Go | All versions | 2.0.7 |
github.com/containerd/containerd/v2 Go | All versions | 2.0.7 |
github.com/containerd/containerd/v2 Go | From 2.1.0-beta.0 | 2.1.5 |
github.com/containerd/containerd/v2 Go | From 2.1.0-beta.0 | 2.1.5 |
github.com/containerd/containerd/v2 Go | From 2.2.0-beta.0 | 2.2.0 |
4 more packages
github.com/containerd/containerd/v2 Go | From 2.2.0-beta.0 | 2.2.0 |
github.com/containerd/containerd Go | All versions | 1.7.29 |
github.com/containerd/containerd Go | All versions | 1.7.29 |
github.com/containerd/containerd Go | All versions | 1.7.29 |
Products include Linuxfoundation Containerd.
How do I fix CVE-2025-64329?
Upgrade github.com/containerd/containerd/v2 to a fixed version for your release line: 2.0.7, 2.1.5 or 2.2.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-64329 being exploited?
There is no known exploitation of CVE-2025-64329 in the wild and no public exploit code.
Other vulnerabilities in containerd
- CVE-2026-53488 containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
- CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
- CVE-2026-53489 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
- CVE-2025-47290 Containerd vulnerable to host filesystem access during image unpack
- CVE-2026-46680 containerd user ID handling bypass allows runAsNonRoot evasion
Sources
Also known as AZL-69739, AZL-69745, AZL-69973, AZL-69976, BELL-CVE-2025-64329, CLEANSTART-2026-DK18368 and 96 more.