CVE-2025-52565
NoneCVSS
—
EPSS
0.6%
Published
Nov 6, 2025
CISA due date
—
Cloudanix analysis
A bug in the software that starts containers can let someone inside a container break out and take over the machine that runs it.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- Container Runtime
- Class
- Container Escape
- Remediation
- Upgrade
- Effort
- Low
- Patch risk
- Low
What it actually does
A race condition in runc during /dev/console bind-mount setup lets a container influence host filesystem operations performed by privileged runc. Winning the race can cause runc to open or write attacker-chosen host paths (including runtime binaries and other sensitive files), breaking namespace, cgroup, and mount isolation and yielding host-level code execution.
Why it matters to the business
A successful breakout turns any untrusted or compromised container into a host and cluster compromise, exposing secrets, adjacent workloads, node credentials, and cloud metadata. runc is the default OCI runtime behind Docker, containerd, CRI-O, Kubernetes, GKE, and Cloud Run, so blast radius is platform-wide until nodes and runtime packages are patched. The issue is not in KEV, EPSS remains low (~0.0057 with no material 30-day rise), and public exploit maturity is none, but Google has issued GKE and Cloud Run guidance on this runc breakout family, so delayed patching still leaves isolation guarantees untrustworthy for multi-tenant and CI workloads.
How an attack unfolds
An attacker who can start a container from a malicious image or who already controls a container filesystem prepares a layout that races runc’s /dev/console mount during create/start. Privileged runc on the host bind-mounts the console into the container; by swapping the mount target at that moment (for example via a symlink or remount), the attacker redirects runc’s open/write of the console onto a host path they choose. That host write can overwrite the runc binary or other privileged files, after which subsequent container operations execute attacker-controlled code on the host. The same breakout class is tracked with CVE-2025-31133 and CVE-2025-52881 and has been called out in GKE and Cloud Run runc-escape advisories. No in-the-wild exploit maturity is reported.
How to fix it
Upgrade opencontainers/runc to a build that includes commit eeb7e6024f9ee43876301b1d23c353384fa6dcdd (or a later patched release from your distro/runtime vendor) and roll it to every node. Refresh containerd, CRI-O, Docker, and Kubernetes node images that vendor runc rather than patching runc in isolation. For Red Hat JBoss EAP 7.3, apply eap7-jackson-databind 0:2.10.4-1.redhat_00002.1.el6eap or 0:2.10.4-1.redhat_00002.1.el7eap where those packages are in scope. Rebuild or recycle long-lived nodes and serverless revisions so old runc binaries are not left on disk. Restrict who can run privileged or untrusted containers until the runtime is patched.
How to confirm the fix worked
On every node, confirm the installed runc binary is at or after eeb7e6024f9ee43876301b1d23c353384fa6dcdd (or the vendor package that contains that fix); check docker, containerd, CRI-O, and kubelet-bundled copies, not only /usr/bin/runc. Restart kubelet/container runtime and drain/replace nodes so in-memory runtimes reload. Verify `runc --version` and package NEVR against the patched advisory, and confirm new containers start without the old console-mount behavior. Inventory remaining privileged pods and untrusted image sources as residual exposure.
Typical attack path
- Obtain the ability to run or influence a container (malicious image, compromised workload, or untrusted build) on a node using vulnerable runc.
- During runc create/start, race the /dev/console bind-mount so the host process operates on an attacker-controlled path instead of the real console device.
- Use the resulting privileged host file open or write to modify runtime binaries or other host objects.
- Execute code on the host outside the container’s namespaces and cgroups.
- Steal node or cloud credentials and move laterally to other containers and cluster services.
How to detect it
There is no public exploit maturity and no KEV/ransomware use, so prioritize integrity and runtime telemetry over signature matching. Review container runtime and kubelet logs around create/start for console or /dev/console mount failures and unexpected path substitutions. Use auditd/eBPF/FIM on host runc binaries (/usr/bin/runc, /usr/sbin/runc, /usr/libexec/crio/runc, and runtime-bundled copies) for writes, truncates, or replacements not tied to a package manager. Alert on symlink or bind-mount activity targeting console from container rootfs during runc init, and on runc or containerd-shim processes opening unexpected host paths. In GKE and Cloud Run, follow provider runc-breakout guidance and inspect node/revision images that predate the patched runtime. Correlate with unexpected node-level processes spawned immediately after a container start from an untrusted image.
- /dev/console
- runc:[2:INIT]
- /usr/bin/runc
- /usr/sbin/runc
- /usr/libexec/crio/runc
- containerd-shim
- operation not permitted.*console
- bind mount.*console
- symlink.*console
What your security team should do
- Patch runc (commit eeb7e6024f9ee43876301b1d23c353384fa6dcdd or vendor equivalent) on all Kubernetes, GKE, Cloud Run, Docker, and CRI-O nodes and recycle them.
- Treat this as a host-isolation defect: assume any node that ran untrusted images while vulnerable may need credential rotation and integrity review of the runc binary and related host paths.
- Block privileged containers, hostPath mounts, and untrusted image sources until runtimes are confirmed patched.
- Hunt for unexpected modification of runc binaries and anomalous console-mount activity around container start, using the detection guidance below.
- Track sibling runc breakouts CVE-2025-31133 and CVE-2025-52881 so the same nodes are not left half-patched.
The record
container escape due to /dev/console mount and related races
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/opencontainers/runc | 1.0.0-rc3 | 1.2.8 |
| Go | github.com/opencontainers/runc | 1.3.0-rc.1 | 1.3.3 |
| Go | github.com/opencontainers/runc | 1.4.0-rc.1 | 1.4.0-rc.3 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.10.1-2.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | buildah | 0 | 2:1.33.12-2.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | buildah | 0 | 2:1.33.12-2.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | buildah | 0 | 2:1.33.12-2.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | buildah-tests | 0 | 2:1.33.12-2.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | buildah-tests | 0 | 2:1.33.12-2.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | cockpit-podman | 0 | 84.1-1.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | conmon | 0 | 3:2.1.10-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | container-selinux | 0 | 2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-6.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-6.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.4.0-6.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | containers-common | 0 | 2:1-82.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+3901+4b80ecd7 |
| AlmaLinux:8 | crit | 0 | 3.18-5.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | criu | 0 | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | criu-devel | 0 | 3.18-5.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | criu-libs | 0 | 3.18-5.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | crun | 0 | 1.14.3-2.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.13-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-2.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-2.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | netavark | 0 | 2:1.10.3-1.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.10-1.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | podman | 0 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | podman | 0 | 4:4.9.4-23.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | podman-catatonit | 0 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | podman-catatonit | 0 | 4:4.9.4-23.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | podman-docker | 0 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | podman-gvproxy | 0 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | podman-gvproxy | 0 | 4:4.9.4-23.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | podman-plugins | 0 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | podman-plugins | 0 | 4:4.9.4-23.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | podman-remote | 0 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | podman-remote | 0 | 4:4.9.4-23.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | podman-tests | 0 | 4:4.9.4-23.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | podman-tests | 0 | 4:4.9.4-23.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+3970+8445edf6 |
| AlmaLinux:8 | python3-criu | 0 | 3.18-5.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | python3-podman | 0 | 4.9.0-3.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | runc | 0 | 4:1.2.5-2.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-4.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | skopeo | 0 | 2:1.14.5-4.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-4.module_el8.10.0+4016+efd18bf8 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-4.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.14.5-4.module_el8.10.0+4068+0e21408f |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+3926+f12484f5 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.3-1.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+3876+e55593a8 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.5-2.module_el8.10.0+4047+545787c4 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3858+6ad51f9f |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+3909+6e1c1eb7 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.5-2.module_el8.10.0+4023+db236c53 |
| AlmaLinux:8 | udica | 0 | 0.2.6-21.module_el8.10.0+4068+0e21408f |
| AlmaLinux:9 | runc | 0 | 4:1.2.5-3.el9_6 |
| AlmaLinux:9 | runc | 0 | 4:1.3.0-4.el9_7 |
| Chainguard | azure-container-networking | 0 | 1.7.4-r3 |
| Chainguard | azure-vnet-cni | 0 | 1.7.4-r2 |
| Chainguard | buildah | 0 | 1.42.0-r1 |
| Chainguard | cluster-autoscaler-1.31 | 0 | 1.31.5-r3 |
| Chainguard | cluster-autoscaler-1.31 | 0 | 1.31.5-r4 |
| Chainguard | cluster-autoscaler-1.31-compat | 0 | 1.31.5-r1 |
| Chainguard | cluster-autoscaler-fips-1.31 | 0 | 1.31.5-r3 |
| Chainguard | cluster-autoscaler-fips-1.31 | 0 | 1.31.5-r5 |
| Chainguard | cluster-autoscaler-fips-1.31-compat | 0 | 1.31.5-r1 |
| Chainguard | eks-distro-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-coredns-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-coredns-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-coredns-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-coredns-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-coredns-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-coredns-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-apiserver-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-apiserver-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-apiserver-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kube-apiserver-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kube-controller-manager-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-proxy-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-proxy-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-proxy-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kube-proxy-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-proxy-fips-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-scheduler-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-scheduler-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kube-scheduler-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kube-scheduler-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-scheduler-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kube-scheduler-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-validation-webhook-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.29 | 0 | 1.29.53-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.31 | 0 | 1.31.35-r1 |
| Chainguard | eks-distro-kubernetes-pause-1.32 | 0 | 1.32.28-r1 |
| Chainguard | eks-distro-kubernetes-pause-compat-1.30 | 0 | 1.30.46-r1 |
| Chainguard | eks-distro-kubernetes-pause-compat-1.31 | 0 | 1.31.35-r1 |
| Chainguard | falco-dev | 0 | 0.42.1-r0 |
| Chainguard | falco-no-driver | 0 | 0.43.0-r0 |
| Chainguard | falco-plugin-container | 0 | 0.42.0-r2 |
| Chainguard | falco-src | 0 | 0.42.1-r0 |
| Chainguard | grafana-alloy | 0 | 1.11.3-r1 |
| Chainguard | grafana-alloy-compat | 0 | 1.11.3-r1 |
| Chainguard | grafana-alloy-fips | 0 | 1.11.3-r2 |
| Chainguard | k3s-1.32 | 0 | 1.32.9.1-r2 |
| Chainguard | k3s-1.33 | 0 | 1.33.5.1-r2 |
| Chainguard | k3s-multicall-1.32 | 0 | 1.32.9.1-r2 |
| Chainguard | k3s-multicall-1.33 | 0 | 1.33.5.1-r2 |
| Chainguard | k3s-static-1.32 | 0 | 1.32.9.1-r2 |
| Chainguard | k3s-static-1.33 | 0 | 1.33.5.1-r2 |
Related vulnerabilities
- CVE-2025-64750 SingularityCE and SingularityPRO are open source container platforms. Also affects github.com/opencontainers/runc
- CVE-2025-65105 Apptainer ineffective application of selinux and apparmor --security options Also affects github.com/opencontainers/runc
- CVE-2025-31133 runc container escape via "masked path" abuse due to mount race conditions Also affects github.com/opencontainers/runc
- CVE-2025-52881 runc container escape and denial of service due to arbitrary write gadgets and procfs… Also affects github.com/opencontainers/runc
- CVE-2024-45310 runc is a CLI tool for spawning and running containers according to the OCI specification. Also affects github.com/opencontainers/runc
- CVE-2024-21626 runc is a CLI tool for spawning and running containers on Linux according to the OCI… Also affects github.com/opencontainers/runc
- CVE-2025-47913 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and… Also affects aardvark-dns
- CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data… Also affects aardvark-dns