CVE-2025-4437
published 2025-08-20CVE-2025-4437: There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts…
PriorityP425medium5.7CVSS 3.1
AVNACLPRLUIRSUCNINAH
EPSS
0.25%
15.3th percentile
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | cri-o_cri-o | 0 – 1.33.3 | — |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
cri-o /etc/passwd os.ReadFile denial of service
vuldb·2026-08-22·CVSS 5.7
CVE-2025-4437 [MEDIUM] cri-o /etc/passwd os.ReadFile denial of service
A vulnerability categorized as problematic has been discovered in cri-o. This impacts the function os.ReadFile of the file /etc/passwd. The manipulation results in denial of service.
This vulnerability is known as CVE-2025-4437. Access to the local network is required for this attack. No exploit is available.
OSV
CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o
osv·2025-08-29
CVE-2025-4437 CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o
CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o
CRI-O has Potential High Memory Consumption from File Read in github.com/cri-o/cri-o
GHSA
CRI-O has Potential High Memory Consumption from File Read
ghsa·2025-08-20
CVE-2025-4437 [MEDIUM] CWE-770 CRI-O has Potential High Memory Consumption from File Read
CRI-O has Potential High Memory Consumption from File Read
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
OSV
CRI-O has Potential High Memory Consumption from File Read
osv·2025-08-20
CVE-2025-4437 [MEDIUM] CRI-O has Potential High Memory Consumption from File Read
CRI-O has Potential High Memory Consumption from File Read
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
Red Hat
cri-o: Large /etc/passwd file may lead to Denial of Service
vendor_redhat·2025-06-26·CVSS 5.7
CVE-2025-4437 [MEDIUM] CWE-770 cri-o: Large /etc/passwd file may lead to Denial of Service
cri-o: Large /etc/passwd file may lead to Denial of Service
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-4437 cri-o1.29: Large /etc/passwd file may lead to Denial of Service [fedora-42]
bugzilla·2025-06-26·CVSS 5.7
CVE-2025-4437 [MEDIUM] CVE-2025-4437 cri-o1.29: Large /etc/passwd file may lead to Denial of Service [fedora-42]
CVE-2025-4437 cri-o1.29: Large /etc/passwd file may lead to Denial of Service [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2375084
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Bugzilla
CVE-2025-4437 cri-o1.30: Large /etc/passwd file may lead to Denial of Service [fedora-42]
bugzilla·2025-06-26·CVSS 5.7
CVE-2025-4437 [MEDIUM] CVE-2025-4437 cri-o1.30: Large /etc/passwd file may lead to Denial of Service [fedora-42]
CVE-2025-4437 cri-o1.30: Large /etc/passwd file may lead to Denial of Service [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2375084
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Bugzilla
CVE-2025-4437 cri-o: Large /etc/passwd file may lead to Denial of Service [fedora-42]
bugzilla·2025-06-26·CVSS 5.7
CVE-2025-4437 [MEDIUM] CVE-2025-4437 cri-o: Large /etc/passwd file may lead to Denial of Service [fedora-42]
CVE-2025-4437 cri-o: Large /etc/passwd file may lead to Denial of Service [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2375084
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Pa
Bugzilla
CVE-2025-4437 cri-o1.31: Large /etc/passwd file may lead to Denial of Service [fedora-42]
bugzilla·2025-06-26·CVSS 5.7
CVE-2025-4437 [MEDIUM] CVE-2025-4437 cri-o1.31: Large /etc/passwd file may lead to Denial of Service [fedora-42]
CVE-2025-4437 cri-o1.31: Large /etc/passwd file may lead to Denial of Service [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2375084
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Bugzilla
CVE-2025-4437 cri-o: Large /etc/passwd file may lead to Denial of Service
bugzilla·2025-06-26·CVSS 5.7
CVE-2025-4437 [MEDIUM] CVE-2025-4437 cri-o: Large /etc/passwd file may lead to Denial of Service
CVE-2025-4437 cri-o: Large /etc/passwd file may lead to Denial of Service
When running a container using the `securityContext.runAsUser` setting to specify which user the container should use to be ran, if the requested user is not present in the '/etc/passwd' file in the container image, cri-o tries to create the new user information. For that cri-o reads the passwd file into the memory all at once using os.ReadFile() function, if the read passwd file is too big it can lead to increased memory consumption, eventually resulting in a Denial of Service.
2025-08-20
Published