CVE-2025-4437
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
There's a vulnerability in the CRI-O application where when a container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running on the same host.
Risk Assessment
An attacker can cause memory exhaustion on the host, potentially leading to crashes of other containers and services, causing downtime.
Recommendation
Update CRI-O to a patched version and avoid running containers with non-existent user IDs.
Other vulnerabilities in CRI-O
See all- CVE-2026-76061Medium
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty prefix, a malicious container or local attacker could use a hostPath containing an intermediate absolute symlink, causing the bind mount source to resolve outside the intended prefixed root.
- CVE-2026-62146High
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
- CVE-2026-92574High
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration.
- CVE-2026-15801High
A vulnerability in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem.
- CVE-2026-17113Medium
CRI-O has a vulnerability in environment-variable handling during container creation. When a CreateContainer request has a nil Envs field, CRI-O uses unfiltered config.Env entries from the OCI image, which can cause a Go panic and crash the crio daemon. This occurs when an entry lacks '='.
- CVE-2026-15809High
A flaw was found in CRI-O where the fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME variable, enabling arbitrary lines to be added to /etc/passwd.
- CVE-2024-5154High
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
Original NVD description (English source)
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS