865 matches found
CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2
CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2. A patched version of the package is available...
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
...
GO-2025-3897 CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o
CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o...
AZL-66728 CVE-2025-58058 affecting package cri-o 1.30.1-1
xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...
CVE-2025-4437
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...
GHSA-J5PM-7495-QMR3 vulnerabilities
Vulnerabilities for packages: cert-manager-fips, kuberay-operator-fips, gitlab-cng, vault-fips, etcd, otel-cli, stakater-reloader-fips, aws-flb-firehose-fips, prometheus-postgres-exporter-fips, kubernetes-csi-driver-nfs, teleport, jaeger-operator-fips, wolfictl, kube-logging-logging-operator,...
Gold Melody IAB Exploits Exposed ASP.NET Machine Keys for Unauthorized Access to Targets
The Initial Access Broker IAB known as Gold Melody has been attributed to a campaign that exploits leaked ASP.NET machine keys to obtain unauthorized access to organizations and peddle that access to other threat actors. The activity is being tracked by Palo Alto Networks Unit 42 under the monike...
Allocation of Resources Without Limits or Throttling
Overview github.com/cri-o/cri-o/server is an OCI-based implementation of Kubernetes Container Runtime Interface Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of the /etc/passwd file. An attacker with minimal privileges to...
TencentOS Server 4: cri-o (TSSA-2025:0033)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0033 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
Important: cri-tools
Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...
Amazon Linux 2 : cri-tools (ALAS-2025-2870)
The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2870 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning...
Important: cri-tools
Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...
SUSE CVE-2025-47291
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...
Denial Of Service (DoS)
github.com/containerd/containerd is vulnerable to a Denial Of Service DoS. The vulnerability is due to a bug in containerd’s CRI implementation where usernamespaced containers are not placed under Kubernetes' cgroup hierarchy, allowing an attacker to bypass resource limits and potentially exhaust...
Fedora: Security Advisory (FEDORA-2025-37c6639afe)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
UBUNTU-CVE-2025-47291
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...
GHSA-CXFP-7PVR-95FF containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
Impact A bug was found in the containerd's CRI implementation where containerd doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. Patches This bug has been fixed...
CVE-2025-47291 containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...
CVE-2025-47291 containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not...