CVE-2025-64329
Publication date 7 November 2025
Last updated 29 January 2026
Ubuntu priority
Description
containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| containerd | 25.10 questing |
Fixed 1.7.24~ds1-8ubuntu1.1
|
| 24.04 LTS noble |
Fixed 1.6.24~ds1-1ubuntu1.3+esm2
|
|
| 22.04 LTS jammy |
Fixed 1.6.12-0ubuntu1~22.04.10
|
|
| 20.04 LTS focal |
Fixed 1.6.12-0ubuntu1~20.04.8+esm1
|
|
| 18.04 LTS bionic |
Fixed 1.6.12-0ubuntu1~18.04.1+esm3
|
|
| 16.04 LTS xenial |
Fixed 1.2.6-0ubuntu1~16.04.6+esm6
|
|
| containerd-app | 25.10 questing |
Fixed 2.1.3-0ubuntu3.1
|
| 24.04 LTS noble |
Fixed 1.7.28-0ubuntu1~24.04.2
|
|
| 22.04 LTS jammy |
Fixed 1.7.28-0ubuntu1~22.04.1+esm1
|
|
| 20.04 LTS focal |
Fixed 1.7.24-0ubuntu1~20.04.2+esm1
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
alexmurray
Traditionally the containerd source package contained both the library and docker application. However, in releases that contain the containerd-app source package, the containerd source package contains only the library whilst the docker application itself is contained in the containerd-app package.
References
Related Ubuntu Security Notices (USN)
- USN-7983-1
- containerd vulnerabilities
- 29 January 2026