CVE-2025-67499
Medium · 6.6CVSS
6.6
EPSS
0.1%
Published
Dec 10, 2025
CISA due date
—
The record
The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port. This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does not have this vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/containernetworking/plugins | 1.6.0 | 1.9.0 |
| Chainguard | amazon-k8s-cni-fips | 0 | 1.20.5-r2 |
| Chainguard | amazon-k8s-cni-init-fips | 0 | 1.20.5-r2 |
| Chainguard | amazon-k8s-cni-init-fips-compat | 0 | 1.20.5-r2 |
| Chainguard | azure-ipam | 0 | 0.4.0-r7 |
| Chainguard | azure-ipam-dropgz | 0 | 0.4.0-r7 |
| Chainguard | buildah | 0 | 1.42.2-r2 |
| Chainguard | buildctl | 0 | 0.26.2-r2 |
| Chainguard | buildctl-fips | 0 | 0.26.2-r3 |
| Chainguard | buildkitd | 0 | 0.26.2-r2 |
| Chainguard | buildkitd-fips | 0 | 0.26.2-r3 |
| Chainguard | calico-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-apiserver-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-apiserver-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-apiserver-compat-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-apiserver-compat-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-apiserver-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-apiserver-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-app-policy-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-app-policy-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-app-policy-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-app-policy-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-cni-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-cni-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-cni-compat-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-cni-compat-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-cni-compat-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-cni-compat-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-cni-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-cni-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-felix-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-felix-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-felix-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-felix-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-goldmane-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-goldmane-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-goldmane-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-goldmane-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-key-cert-provisioner-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-key-cert-provisioner-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-key-cert-provisioner-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-key-cert-provisioner-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-kube-controllers-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-kube-controllers-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-kube-controllers-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-kube-controllers-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-node-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-node-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-node-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-node-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-pod2daemon-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-pod2daemon-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-pod2daemon-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-pod2daemon-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-pod2daemon-flexvol-compat-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-pod2daemon-flexvol-compat-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-typha-client-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-typha-client-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-typha-client-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-typha-client-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-typhad-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-typhad-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-typhad-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-typhad-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-whisker-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-whisker-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-whisker-backend-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-whisker-backend-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-whisker-backend-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-whisker-backend-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calico-whisker-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calico-whisker-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calicoctl-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calicoctl-3.31 | 0 | 3.31.2-r4 |
| Chainguard | calicoctl-fips-3.30 | 0 | 3.30.5-r3 |
| Chainguard | calicoctl-fips-3.31 | 0 | 3.31.2-r4 |
| Chainguard | containerd-2 | 0 | 2.2.0-r4 |
| Chainguard | containerd-fips | 0 | 2.2.0-r4 |
| Chainguard | containerd-service-2 | 0 | 2.2.0-r4 |
| Chainguard | containerd-service-2.0 | 0 | 2.2.0-r4 |
| Chainguard | containerd-service-fips | 0 | 2.2.0-r4 |
| Chainguard | containerd-shim-runc-v2-2 | 0 | 2.2.0-r4 |
| Chainguard | containerd-shim-runc-v2-2.0 | 0 | 2.2.0-r4 |
| Chainguard | containerd-shim-runc-v2-fips | 0 | 2.2.0-r4 |
| Chainguard | containerd-stress-2 | 0 | 2.2.0-r4 |
| Chainguard | containerd-stress-2.0 | 0 | 2.2.0-r4 |
| Chainguard | containerd-stress-fips | 0 | 2.2.0-r4 |
| Chainguard | ctr-2 | 0 | 2.2.0-r4 |
| Chainguard | ctr-2.0 | 0 | 2.2.0-r4 |
| Chainguard | ctr-fips | 0 | 2.2.0-r4 |
| Chainguard | docker | 0 | 28.5.2-r8 |
| Chainguard | docker-config-mirror-gcr | 0 | 28.5.2-r8 |
| Chainguard | docker-config-mirror-gcr-fips | 0 | 28.5.2-r3 |
| Chainguard | docker-dind | 0 | 28.5.2-r8 |
| Chainguard | docker-dind-compat | 0 | 28.5.2-r8 |
| Chainguard | docker-dind-compat-fips | 0 | 28.5.2-r3 |
| Chainguard | docker-dind-fips | 0 | 28.5.2-r3 |
| Chainguard | docker-fips | 0 | 28.5.2-r3 |
| Chainguard | docker-init | 0 | 28.5.2-r8 |
| Chainguard | docker-init-fips | 0 | 28.5.2-r3 |
| Chainguard | docker-modprobe-compat | 0 | 28.5.2-r8 |
| Chainguard | docker-oci-entrypoint | 0 | 28.5.2-r8 |
| Chainguard | docker-oci-entrypoint-fips | 0 | 28.5.2-r3 |
| Chainguard | docker-rootless | 0 | 28.5.2-r8 |
| Chainguard | docker-rootless-fips | 0 | 28.5.2-r3 |
| Chainguard | dockerd | 0 | 28.5.2-r8 |
| Chainguard | dockerd-fips | 0 | 28.5.2-r3 |
| Chainguard | dockerd-oci-entrypoint | 0 | 28.5.2-r8 |
| Chainguard | dockerd-oci-entrypoint-fips | 0 | 28.5.2-r3 |
| Chainguard | dockerd-service | 0 | 28.5.2-r8 |
| Chainguard | dockerd-service-fips | 0 | 28.5.2-r3 |
| Chainguard | flannel | 0 | 0.27.4-r6 |
| Chainguard | flannel-compat | 0 | 0.27.4-r6 |
| Chainguard | flannel-fips | 0 | 0.27.4-r4 |
| Chainguard | flannel-fips-compat | 0 | 0.27.4-r4 |
| Chainguard | istio-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istio-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istio-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-cni-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istio-cni-1.25-compat | 0 | 1.25.5-r5 |
| Chainguard | istio-cni-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-cni-1.26-compat | 0 | 1.26.7-r1 |
| Chainguard | istio-cni-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istio-cni-1.27-compat | 0 | 1.27.4-r1 |
| Chainguard | istio-cni-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-cni-1.28-compat | 0 | 1.28.1-r1 |
| Chainguard | istio-cni-fips-1.25 | 0 | 1.25.5-r6 |
| Chainguard | istio-cni-fips-1.25-compat | 0 | 1.25.5-r6 |
| Chainguard | istio-cni-fips-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-cni-fips-1.26-compat | 0 | 1.26.7-r1 |
| Chainguard | istio-cni-fips-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-cni-fips-1.28-compat | 0 | 1.28.1-r1 |
| Chainguard | istio-fips-1.25 | 0 | 1.25.5-r6 |
| Chainguard | istio-fips-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-fips-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-install-cni-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istio-install-cni-1.25-compat | 0 | 1.25.5-r5 |
| Chainguard | istio-install-cni-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-install-cni-1.26-compat | 0 | 1.26.7-r1 |
| Chainguard | istio-install-cni-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istio-install-cni-1.27-compat | 0 | 1.27.4-r1 |
| Chainguard | istio-install-cni-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-install-cni-1.28-compat | 0 | 1.28.1-r1 |
| Chainguard | istio-install-cni-fips-1.25 | 0 | 1.25.5-r6 |
| Chainguard | istio-install-cni-fips-1.25-compat | 0 | 1.25.5-r6 |
| Chainguard | istio-install-cni-fips-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-install-cni-fips-1.26-compat | 0 | 1.26.7-r1 |
| Chainguard | istio-install-cni-fips-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istio-install-cni-fips-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-install-cni-fips-1.28-compat | 0 | 1.28.1-r1 |
| Chainguard | istio-pilot-agent-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istio-pilot-agent-1.25-compat | 0 | 1.25.5-r5 |
| Chainguard | istio-pilot-agent-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-pilot-agent-1.26-compat | 0 | 1.26.7-r1 |
| Chainguard | istio-pilot-agent-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istio-pilot-agent-1.27-compat | 0 | 1.27.4-r1 |
| Chainguard | istio-pilot-agent-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-pilot-agent-1.28-compat | 0 | 1.28.1-r1 |
| Chainguard | istio-pilot-agent-fips-1.25 | 0 | 1.25.5-r6 |
| Chainguard | istio-pilot-agent-fips-1.25-compat | 0 | 1.25.5-r6 |
| Chainguard | istio-pilot-agent-fips-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-pilot-agent-fips-1.26-compat | 0 | 1.26.7-r1 |
| Chainguard | istio-pilot-agent-fips-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-pilot-agent-fips-1.28-compat | 0 | 1.28.1-r1 |
| Chainguard | istio-pilot-discovery-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istio-pilot-discovery-1.25-compat | 0 | 1.25.5-r5 |
| Chainguard | istio-pilot-discovery-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-pilot-discovery-1.26-compat | 0 | 1.26.7-r1 |
| Chainguard | istio-pilot-discovery-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istio-pilot-discovery-1.27-compat | 0 | 1.27.4-r1 |
| Chainguard | istio-pilot-discovery-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istio-pilot-discovery-1.28-compat | 0 | 1.28.1-r1 |
| Chainguard | istio-pilot-discovery-fips-1.25 | 0 | 1.25.5-r6 |
| Chainguard | istio-pilot-discovery-fips-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istio-pilot-discovery-fips-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istioctl-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istioctl-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istioctl-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istioctl-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istioctl-bash-completion-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istioctl-bash-completion-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istioctl-bash-completion-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istioctl-bash-completion-1.28 | 0 | 1.28.1-r1 |
| Chainguard | istioctl-zsh-completion-1.25 | 0 | 1.25.5-r5 |
| Chainguard | istioctl-zsh-completion-1.26 | 0 | 1.26.7-r1 |
| Chainguard | istioctl-zsh-completion-1.27 | 0 | 1.27.4-r1 |
| Chainguard | istioctl-zsh-completion-1.28 | 0 | 1.28.1-r1 |
| Chainguard | k3s | 0 | 1.35.3.1-r0 |
| Chainguard | k3s-1.33 | 0 | 1.33.10.1-r0 |
| Chainguard | k3s-multicall | 0 | 1.34.2.1-r1 |
| Chainguard | k3s-multicall-1.32 | 0 | 1.32.10.1-r1 |
| Chainguard | k3s-multicall-1.33 | 0 | 1.33.6.1-r2 |
| Chainguard | k3s-static | 0 | 1.35.3.1-r0 |
| Chainguard | k3s-static-1.33 | 0 | 1.33.10.1-r0 |
| Chainguard | kuma-2.10 | 0 | 2.10.8-r3 |
| Chainguard | kuma-2.11 | 0 | 2.11.7-r3 |
Related vulnerabilities
- CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Also affects amazon-k8s-cni-fips
- CVE-2026-27142 Actions which insert URLs into the content attribute of HTML meta tags are not escaped. Also affects amazon-k8s-cni-fips
- CVE-2026-27139 On Unix platforms, when listing the contents of a directory using File.ReadDir or… Also affects amazon-k8s-cni-fips
- CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid… Also affects amazon-k8s-cni-fips
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects amazon-k8s-cni-fips
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects amazon-k8s-cni-fips
- CVE-2025-68121 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or… Also affects amazon-k8s-cni-fips
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects amazon-k8s-cni-fips