CVE-2025-64435
Medium · 5.3KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation
CVSS
5.3
EPSS
0.4%
Published
Nov 6, 2025
CISA due date
—
The record
_Short summary of the problem. Make the impact and severity as clear as possible. A logic flaw in the `virt-controller` allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate `virt-launcher` pod associated with the VMI. This can mislead the `virt-controller` into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/kubevirt/kubevirt | 0 | 1.7.0-beta.0 |
| Go | kubevirt.io/kubevirt | 0 | 1.7.0-beta.0 |
| SUSE:Linux Enterprise Module for Containers 15 SP7 | kubevirt | 0 | 1.7.0-150700.3.16.2 |
| openSUSE:Leap 16.0 | kubevirt | 0 | 1.7.0-160000.1.1 |
Related vulnerabilities
- GO-2025-4105 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation in kubevirt.io/kubevirt Same vulnerability
- GO-2025-4104 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between… Also affects github.com/kubevirt/kubevirt
- CVE-2025-64433 KubeVirt Arbitrary Container File Read Also affects github.com/kubevirt/kubevirt
- CVE-2025-64436 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes Also affects github.com/kubevirt/kubevirt
- GO-2026-4384 KubeVirt Guest Agent DoS via Excessive Network Interface Reports in kubevirt.io/kubevirt Also affects kubevirt.io/kubevirt
- CVE-2025-14525 A flaw was found in kubevirt. Also affects kubevirt.io/kubevirt
- CVE-2025-64432 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer Also affects kubevirt.io/kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write Also affects kubevirt.io/kubevirt