# github.com/cri-o/cri-o (Go) vulnerabilities 12 known vulnerabilities (5 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pkg.go.dev/github.com/cri-o/cri-o ## Advisories (12) ### [CVE-2025-4437](https://cve.now/CVE-2025-4437): Cri-o: large /etc/passwd file may lead to denial of service - Severity: Medium 5.7 - Published: Aug 20, 2025 - Affected: through 1.33.3; all versions. ### [CVE-2025-0750](https://cve.now/CVE-2025-0750): Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting - Severity: Medium 6.6 - Published: Jan 28, 2025 - Affected: through 1.33.0; all versions. ### [CVE-2024-8676](https://cve.now/CVE-2024-8676): Cri-o: checkpoint restore can be triggered from different namespaces - Severity: High 7.4 - Published: Nov 26, 2024 - Affected: fixed in 1.29.11; from 1.30.0, fixed in 1.30.8; from 1.31.0, fixed in 1.31.3; fixed in 1.29.11; from 1.30.0, fixed in 1.30.8; from 1.31.0, fixed in 1.31.3. ### [CVE-2024-5154](https://cve.now/CVE-2024-5154): Cri-o: malicious container can create symlink on host - Severity: High 8.1 - Published: Jun 12, 2024 - Affected: from 1.28.6, fixed in 1.28.7; from 1.29.4, fixed in 1.29.5; from 1.30.0, fixed in 1.30.1; from 1.28.6, fixed in 1.28.7; from 1.29.4, fixed in 1.29.5; from 1.30.0, fixed in 1.30.1. ### [CVE-2024-3154](https://cve.now/CVE-2024-3154): Cri-o: arbitrary command injection via pod annotation - Severity: High 7.2 - Published: Apr 26, 2024 - Affected: fixed in 1.27.6; from 1.28.0, fixed in 1.28.6; from 1.29.0, fixed in 1.29.4; from 1.29.0, fixed in 1.29.4; from 1.28.0, fixed in 1.28.6; fixed in 1.27.6. ### [CVE-2023-6476](https://cve.now/CVE-2023-6476): Cri-o: pods are able to break out of resource confinement on cgroupv2 - Severity: Medium 6.5 - Published: Jan 9, 2024 - Affected: fixed in 1.27.3; from 1.28.0, fixed in 1.28.3; from 1.29.0, fixed in 1.29.1; from 1.29.0, fixed in 1.29.1; from 1.28.0, fixed in 1.28.3; fixed in 1.27.3. ### [CVE-2022-4318](https://cve.now/CVE-2022-4318): Cri-o: /etc/passwd tampering privesc - Severity: High 7.8 - Published: Sep 25, 2023 - Affected: fixed in 1.26.0. ### [CVE-2022-2995](https://cve.now/CVE-2022-2995): Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible… - Severity: High 7.1 - Published: Sep 19, 2022 - Affected: fixed in 1.25.0. ### [CVE-2022-1708](https://cve.now/CVE-2022-1708): A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. - Severity: Unrated - Published: Jun 7, 2022 - Affected: fixed in 1.22.5; from 1.23.0, fixed in 1.23.3; from 1.24.0, fixed in 1.24.1; from 1.24.0, fixed in 1.24.1; from 1.23.0, fixed in 1.23.3; fixed in 1.22.5. ### [CVE-2022-27652](https://cve.now/CVE-2022-27652): A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. - Severity: Unrated - Published: Apr 18, 2022 - Affected: fixed in 1.24.0. ### [CVE-2022-0811](https://cve.now/CVE-2022-0811): A flaw was found in CRI-O in the way it set kernel options for a pod. - Severity: Unrated - Published: Mar 16, 2022 - Affected: from 1.19.0, fixed in 1.19.6; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.6; from 1.22.0, fixed in 1.22.3; from 1.23.0, fixed in 1.23.2; from 1.19.0, fixed in 1.19.6; from 1.20.0, fixed in 1.20.7; from 1.21.0, fixed in 1.21.6; from 1.22.0, fixed in 1.22.3; from 1.23.0, fixed in 1.23.2. ### [CVE-2022-0532](https://cve.now/CVE-2022-0532): An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. - Severity: Unrated - Published: Feb 9, 2022 - Affected: fixed in 1.23.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/cri-o/cri-o Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.