Containerd Vulnerability in Kubernetes Implementation by Docker

CVE-2025-47291

What is CVE-2025-47291?

A flaw in containerd's CRI implementation has been identified, causing usernamespaced containers to not be placed under the Kubernetes cgroup hierarchy. This oversight results in certain Kubernetes limits not being enforced, potentially leading to a denial of service for the Kubernetes node. To mitigate this issue, users are advised to update to containerd versions 2.0.5 or later, or 2.1.0 and above. Alternatively, temporarily disabling usernamespaced pods in Kubernetes can be employed as a workaround until the update is applied.

References