CVE-2025-47291
highpriority · track · 30EPSS 0.003 · 20 %ileDEEUUSEPSS · scored 2026-10-23
containerd is an open-source container runtime. A bug was found in the containerd's CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. As a workaround, disable usernamespaced pods in Kubernetes temporarily.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedtrivy-0.66.0-bp160.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedtrivy-0.66.0-bp160.1.1.ppc64le as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedtrivy-0.66.0-bp160.1.1.s390x as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedtrivy-0.66.0-bp160.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedtrivy-0:0.68.2-160000.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedtrivy-0:0.68.2-160000.1.1.ppc64le as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedtrivy-0:0.68.2-160000.1.1.s390x as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedtrivy-0:0.68.2-160000.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.6–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- Go github.com/containerd/containerd/v22.0.1 → 2.0.5osvUSpkg:golang/github.com/containerd/containerd/v2
advisories (4)
Vendor and ecosystem advisories describing this.
- openSUSE-SU-2025:20117-1Security update for trivy2025-11-27csaf · suse_csafDE
Security update for trivy
- openSUSE-SU-2026:20798-1Security update for trivy2026-02-13csaf · suse_csafDE
Security update for trivy
- GHSA-cxfp-7pvr-95ffcontainerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.2025-05-21ghsa · osvUS
# Impact A bug was found in the containerd's CRI implementation where containerd doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. # Patches This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. # Workarounds Disable usernamespaced pods in Kubernetes temporarily. # Credits The containerd project would like to thank Rodrigo Campos Catelin and Piotr Rogowski for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md). # For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at security@containerd.io To report a security issue in containerd: * [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io)
- GO-2025-3701Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd2025-05-23vendor · osvUS
Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://containerd.io/downloads/Patchcnnvd
- https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ffcnnvd
- https://vigilance.fr/vulnerability/containerd-denial-of-service-via-CRI-Cgroup-Hierarchy-49212cnnvd
- https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ffenisa_euvd
- https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ffVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan