Skip to main content

Missing Release of Memory after Effective Lifetime in github.com/containerd/containerd

CVE-2025-64329

  • github.com/containerd/containerd
  • github.com/Containerd/containerd
  • github.com/Containerd/Containerd
  • github.com/containerd/containerd/v2
  • github.com/containerd/Containerd/v2
Medium
6.9/10

Summary

Containerd is an open-source container runtime. Versions through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-401 - Missing release of memory after effective lifetime (memory leak)

'Missing release of memory after effective lifetime (memory leak)' is a weakness that occurs when software doesn't effectively release allocated memory after it is used. If not addressed, this enables attackers to launch denial of service attacks (by crashing or hanging the program) or take advantage of other unexpected behavior resulting from low memory conditions.

References

Advisory Timeline

  • Published