CVE-2025-64329

A flaw was found in containerd. This vulnerability allows a user to exhaust memory on the host due to goroutine leaks via a bug in the CRI (Container Runtime Interface) Attach implementation.

The highest threat of this vulnerability is to system availability. A flaw in containerd's CRI Attach implementation allows a user to exhaust memory on the host due to goroutine leaks, leading to a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, set up an admission controller to control access to the pods/attach subresource. Restricting which users and service accounts can perform attach operations limits their ability to trigger the goroutine leak in containerd's CRI Attach implementation and exhaust memory on the host. Upstream has fixed this issue in containerd 1.7.29, 2.0.7, 2.1.5, and 2.2.0; apply updated containerd packages through the affected Red Hat product's update channels when available.