Denial of Service Risk in containerd-app: CVE-2025-47291
Summary
UBUNTU-CVE-2025-47291: containerd is an open-source container runtime. Affects containerd-app versions 1.7.19-0ubuntu1 – 2.0.5-0ubuntu1~25.04.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an open-source container runtime that manages the lifecycle of containers on a host system. It is widely used in Kubernetes environments to facilitate container orchestration. The package 'containerd-app' version 2.0.5-0ubuntu1~25.04.1 is part of this ecosystem and is crucial for managing container workloads efficiently. However, a vulnerability has been identified that affects its operation within Kubernetes, potentially leading to service disruptions.
Vulnerability Detail
A bug was discovered in the CRI (Container Runtime Interface) implementation of containerd, where versions starting from 2.0.1 and prior to 2.0.5 do not correctly place usernamespaced containers under the Kubernetes cgroup hierarchy. This oversight means that certain resource limits defined in Kubernetes may not be enforced, leading to a denial of service on the Kubernetes node. This vulnerability could allow containers to consume excessive resources, impacting the stability and performance of the entire Kubernetes cluster.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable usernamespaced pods in Kubernetes to mitigate the risk until the package is updated. This can be done by modifying the Kubernetes configuration to not allow usernamespaced pods.
Conclusion
The vulnerability CVE-2025-47291 in the containerd-app package poses a significant risk to Kubernetes environments by potentially allowing resource limits to be ignored. Users are advised to update to the patched version 2.0.5 or later to mitigate this risk. In the meantime, disabling usernamespaced pods can serve as a temporary measure.
See every vulnerability recorded for containerd-app →
FAQ
CVE-2025-47291 is a vulnerability in the containerd-app package that can lead to denial of service in Kubernetes environments.
The vulnerability may prevent Kubernetes from enforcing resource limits on containers, potentially leading to resource exhaustion and service disruptions.
Versions of containerd-app starting from 2.0.1 and prior to 2.0.5 are affected by this vulnerability.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability. Visit Vulert Scanner to use the Vulert playground.
If an immediate update is not possible, consider disabling usernamespaced pods in your Kubernetes configuration as a temporary workaround.
