GHSA-m6hq-p25p-ffr2 containerd CRI server: Host memory exhaustion through Attach goroutine leak

• Go github.com/containerd/containerd: < 1.7.29 → fixed in 1.7.29 • Go github.com/containerd/containerd/v2: < 2.0.7 → fixed in 2.0.7 • Go github.com/containerd/containerd/v2: >= 2.1.0-beta.0, < 2.1.5 → fixed in 2.1.5 • Go github.com/containerd/containerd/v2: >= 2.2.0-beta.0, < 2.2.0 → fixed in 2.2.0

Impact A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. Repetitive calls of CRI Attach (e.g., `kubectl attach`) could increase the memory usage of containerd. Patches This bug has been fixed in the following containerd versions: • 2.2.0 • 2.1.5 • 2.0.7 • 1.7.29 Users should update to these versions to resolve the issue. Workarounds Set up an admission controller to control accesses to `pods/attach` resources. e.g., Validating Admission Policy. Credits The containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the containerd security policy. References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329 For more information If you have any questions or comments about this advisory: • Open an issue in containerd • Email us at [email protected] To report a security issue in containerd: • Report a new vulnerability