CVE & CISA-KEV CatalogNVD
CVE-2025-64329
MEDIUM5.5
CVSS v3
Description
containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.
How to fix
Remediation Available
containerdDebian
Fixed in:1.4.13~ds1-1~deb11u6CVE-2025-64329
Fixed in:1.6.20~ds1-1+deb12u3CVE-2025-64329
Fixed in:1.7.24~ds1-6+deb13u1CVE-2025-64329
Fixed in:1.7.24~ds1-10CVE-2025-64329
registry.redhat.io/network-observability/network-observabilityRocky
Fixed in:cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390xRHSA-2026:2900
Fixed in:rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64RHSA-2026:2900
Fixed in:cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64leRHSA-2026:2900
Fixed in:rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64leRHSA-2026:2900
Fixed in:rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390xRHSA-2026:2900
Fixed in:cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64RHSA-2026:2900
Fixed in:operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64RHSA-2026:2900
Fixed in:rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64RHSA-2026:2900
Fixed in:cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64RHSA-2026:2900
registry.redhat.io/network-observability/network-observabilityRed Hat / RHEL
Fixed in:cli-rhel9@sha256:0c677aebfafea3f13c298396e9975da6fb392df0cef1b62df54d66b0f08376a3_arm64RHSA-2026:2900
Fixed in:rhel9-operator@sha256:5938d399221a1f7ad395ea18adf0fd5274e009f1de48114bc4d07968566b7209_amd64RHSA-2026:2900
Fixed in:rhel9-operator@sha256:cfa8bd4f51b690217a305347ac412ee4efed2bdea695fa99f8f771c4f271b59c_arm64RHSA-2026:2900
Fixed in:cli-rhel9@sha256:a852fe93a3de2a35b3f13cfa0ea0600f9518d4b97c123353eb2b4f78202e7967_amd64RHSA-2026:2900
Fixed in:cli-rhel9@sha256:472aaa4cabacdc52ecd2cd9d25710027612cc1c92a4a2685bf5321507028ec0d_ppc64leRHSA-2026:2900
Fixed in:rhel9-operator@sha256:9b5e5c68ff2fdd5ca27e34e8eda5d0e8a230eea65cdfa768a6f6643c1a35da76_ppc64leRHSA-2026:2900
Fixed in:cli-rhel9@sha256:9266caf90f473509cbd104e1d00b57a4695f16cf4e0be53819560821e0236461_s390xRHSA-2026:2900
Fixed in:rhel9-operator@sha256:3180d33b433733fc469a0a8b2bf613f137eba10fd75f8bc586066d4d303a3a5f_s390xRHSA-2026:2900
Fixed in:operator-bundle@sha256:6cc2706d0f934502e78d4f4585e0787a84e6751ff946568c21dbe7a87df699df_amd64RHSA-2026:2900
registry.redhat.io/network-observability/network-observability-consoleRocky
Fixed in:plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64RHSA-2026:2900
Fixed in:plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390xRHSA-2026:2900
Fixed in:plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64RHSA-2026:2900
Fixed in:plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64leRHSA-2026:2900
registry.redhat.io/network-observability/network-observability-consoleRed Hat / RHEL
Fixed in:plugin-rhel9@sha256:bb0f0e05c7bb037cd07c260a8fcea50fb62cc433d8cd504c4bb065f994c359c6_s390xRHSA-2026:2900
Fixed in:plugin-rhel9@sha256:3f4b1539a41af46e0dcc3ee1e06d760b504448190cf1f5963171e504cbcb82e2_ppc64leRHSA-2026:2900
Fixed in:plugin-rhel9@sha256:77695f611b1122150c84ee648c674037c488007684d8644a5fc420e111e447b1_arm64RHSA-2026:2900
Fixed in:plugin-rhel9@sha256:4cb55d496e82d09f2a9f57f1b676d24134b1e4f817e10d4535581d4cb2728502_amd64RHSA-2026:2900
registry.redhat.io/network-observability/network-observability-console-pluginRocky
Fixed in:compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390xRHSA-2026:2900
Fixed in:compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64RHSA-2026:2900
Fixed in:compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64RHSA-2026:2900
Fixed in:compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64leRHSA-2026:2900
registry.redhat.io/network-observability/network-observability-console-pluginRed Hat / RHEL
Fixed in:compat-rhel9@sha256:17be6b67f5ed6757b65df0d59dc5d59130ee2e3510c60453de77fadfd7ca3c16_arm64RHSA-2026:2900
Fixed in:compat-rhel9@sha256:7ed8059b6fb8ccc57c6c6aca6c826e4b45db3079cdf6d2854dec467a94fe46ab_ppc64leRHSA-2026:2900
Fixed in:compat-rhel9@sha256:a9d0f02ab4310c5a2b2026f424a07d35bcd2ab74e5f9fabba10a2514bef29545_amd64RHSA-2026:2900
Fixed in:compat-rhel9@sha256:325db5ee476d5467e24748b6a66def44ff06e91e7e0665f43a49d7df9dbc9870_s390xRHSA-2026:2900
registry.redhat.io/network-observability/network-observability-ebpfRed Hat / RHEL
Fixed in:agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64RHSA-2026:2900
Fixed in:agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64RHSA-2026:2900
Fixed in:agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64leRHSA-2026:2900
Fixed in:agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390xRHSA-2026:2900
registry.redhat.io/network-observability/network-observability-ebpfRocky
Fixed in:agent-rhel9@sha256:0d23eb03050bcf371d44613a679456222b064cd3a6c17ea9a3c34f1ac7e3cbfc_amd64RHSA-2026:2900
Fixed in:agent-rhel9@sha256:e72278e61f7300880988fbac4e4e728e7f2ad14c3061ac39ece0d59a3cd5e228_arm64RHSA-2026:2900
Fixed in:agent-rhel9@sha256:f85ae8937c0d75a29dfe601110e5b358f8d92bb85bb43fff9bc88667ad43e4dc_ppc64leRHSA-2026:2900
Fixed in:agent-rhel9@sha256:619759fd4607dbb26e8ef0d47f50f8ec24323f0766167e4df15c51d6c31b9be7_s390xRHSA-2026:2900
registry.redhat.io/network-observability/network-observability-flowlogsRocky
Fixed in:pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390xRHSA-2026:2900
Fixed in:pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64leRHSA-2026:2900
Fixed in:pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64RHSA-2026:2900
Fixed in:pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64RHSA-2026:2900
registry.redhat.io/network-observability/network-observability-flowlogsRed Hat / RHEL
Fixed in:pipeline-rhel9@sha256:8b660cd90abfe68d05668562155759079e7012448c142234ea3a37e6ee41436d_s390xRHSA-2026:2900
Fixed in:pipeline-rhel9@sha256:84a41b297f620c777236b298ee3dca1656916757cfb043f96c035656f8b9c353_ppc64leRHSA-2026:2900
Fixed in:pipeline-rhel9@sha256:9e495db6e28bb6e38b263557d303081ed3199039dc1e7d18c704be8b64d8dd18_amd64RHSA-2026:2900
Fixed in:pipeline-rhel9@sha256:c2a7793ccbaf491a6018f3dd63b10f29e205441d1dd7ca9184b1b46f6db4b199_arm64RHSA-2026:2900
containerdUbuntu
Fixed in:1.2.6-0ubuntu1~16.04.6+esm6USN-7983-1
Fixed in:1.6.12-0ubuntu1~18.04.1+esm3USN-7983-1
Fixed in:1.6.12-0ubuntu1~20.04.8+esm1USN-7983-1
Fixed in:1.6.12-0ubuntu1~22.04.10USN-7983-1
Fixed in:1.6.24~ds1-1ubuntu1.3+esm2USN-7983-1
Fixed in:1.7.24~ds1-8ubuntu1.1USN-7983-1
containerd-appUbuntu
Fixed in:1.7.24-0ubuntu1~20.04.2+esm1USN-7983-1
Fixed in:1.7.28-0ubuntu1~22.04.1+esm1USN-7983-1
Fixed in:1.7.28-0ubuntu1~24.04.2USN-7983-1
Fixed in:2.1.3-0ubuntu3.1USN-7983-1
golang-github-containerd-containerd-devUbuntu
Fixed in:1.6.12-0ubuntu1~18.04.1+esm3USN-7983-1
Fixed in:1.6.12-0ubuntu1~20.04.8+esm1USN-7983-1
Fixed in:1.6.12-0ubuntu1~22.04.10USN-7983-1
Fixed in:1.6.24~ds1-1ubuntu1.3+esm2USN-7983-1
Fixed in:1.7.24~ds1-8ubuntu1.1USN-7983-1
golang-github-docker-containerd-devUbuntu
Fixed in:1.2.6-0ubuntu1~16.04.6+esm6USN-7983-1
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploit Intelligence
0.16%probability of exploitation in 30 days
6thpercentile
Low risk: more likely to be exploited than 6% of all known CVEs.
References
Patch2
Related Vulnerabilities
Other CWE-401 (Missing Release of Memory (Memory Leak)) vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2020-13934 | High | 7.5 | 64% | - | Fix |
| CVE-2016-6304 | High | 7.5 | 63% | - | Fix |
| CVE-2019-12265 | Medium | 5.3 | 55% | - | Fix |
| CVE-2001-0136 | Medium | 5.0 | 45% | - | - |
| CVE-2016-4232 | High | 7.5 | 36% | - | - |
| CVE-2001-0543 | Medium | 5.0 | 21% | - | - |
Embed a live status badge for CVE-2025-64329
Markdown
[](https://tridentstack.com/cve/CVE-2025-64329)HTML
<a href="https://tridentstack.com/cve/CVE-2025-64329"><img src="https://tridentstack.com/cve/badge/CVE-2025-64329.svg" alt="CVE-2025-64329"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
Start freeThis product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-12-31.