Skip to content
OpenAdvisories
Medium · 5.7 CVE-2025-4437 EUVD-2025-28020GHSA-8f93-j3fx-72f3GO-2025-3897

Cri-o: large /etc/passwd file may lead to denial of service

Published Aug 20, 2025 · Updated Sep 1, 2026 · Assigned by redhat

Description

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat OpenShift Container Platform 4 — —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/cri-o/cri-o <= 1.33.3 — GHSA-8f93-j3fx-72f3
Go github.com/cri-o/cri-o all versions — GO-2025-3897

References