CVE-2025-4437: CRI-O High Memory Consumption Vulnerability
Summary
CVE-2025-4437: CRI-O has Potential High Memory Consumption from File Read. Affects github.com/cri-o/cri-o versions < 1.33.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CRI-O is an open-source container runtime specifically designed for Kubernetes. It allows Kubernetes to manage the lifecycle of containers, providing a lightweight alternative to other container runtimes. CRI-O focuses on simplicity and efficiency, making it a popular choice for cloud-native applications. However, it is susceptible to vulnerabilities that can lead to significant resource consumption and potential denial-of-service scenarios.
Vulnerability Detail
The vulnerability arises when a container is launched with a securityContext.runAsUser that specifies a non-existent user. In this case, CRI-O attempts to create the user by reading the entire /etc/passwd file into memory. If this file is excessively large, it can lead to high memory consumption, causing applications to be killed due to out-of-memory errors. This can result in denial-of-service conditions, potentially disrupting other pods and services running on the same host.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid specifying non-existent users in the securityContext.runAsUser field when launching containers. This will prevent CRI-O from attempting to read the /etc/passwd file and consuming excessive memory.
Conclusion
CVE-2025-4437 presents a significant risk for applications using CRI-O, particularly when launching containers with non-existent users. It is crucial to update to the patched version to mitigate this vulnerability and ensure the stability of your applications.
See every vulnerability recorded for github.com/cri-o/cri-o →
FAQ
CVE-2025-4437 is a vulnerability in the CRI-O container runtime that can lead to high memory consumption and potential denial-of-service.
If your application uses CRI-O and launches containers with non-existent users, it may experience high memory usage, leading to application crashes.
As a temporary measure, avoid using non-existent users in your container configurations to prevent triggering the vulnerability.
You can find detailed information about CVE-2025-4437 on the GitHub advisory database and other security advisory platforms.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cri-o/cri-o.
