CVE-2025-64329 — Missing Release of Memory after Effective Lifetime in Containerd

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-771 — Missing Reference to Active Allocated Resource11 documents8 sources
Severity
6.9MEDIUMNVD
OSV7.8
EPSS
0.0%
top 99.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
ContainerdGithub.com Containerd ContainerdGithub.com Containerd Containerd V2+1 more
Timeline
PublishedNov 7
Latest updateJan 29

Description

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages6 packages

▶CVEListV5containerd/containerd< 1.7.29+3
▶NVDlinuxfoundation/containerd2.0.0 — 2.0.7+3
▶Gogithub.com/containerd_containerd_v22.1.0-beta.0 — 2.1.5+2
▶Debiancontainerd/containerd< 1.4.13~ds1-1~deb11u6+2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
containerd, containerd-app vulnerabilities↗2026-01-29
▶
OSV
containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd↗2025-11-17
▶
CVEList
containerd CRI server: Host memory exhaustion through Attach goroutine leak↗2025-11-07
▶
OSV
CVE-2025-64329: containerd is an open-source container runtime↗2025-11-07
▶
OSV
containerd CRI server: Host memory exhaustion through Attach goroutine leak↗2025-11-06
▶

📋Vendor Advisories

4
Ubuntu
containerd vulnerabilities↗2026-01-29
▶
Microsoft
containerd CRI server: Host memory exhaustion through Attach goroutine leak↗2025-11-11
▶
Red Hat
github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks↗2025-11-07
▶
Debian
CVE-2025-64329: containerd - containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0...↗2025
▶
CVE-2025-64329 — Containerd vulnerability | cvebase