{
  "cveId": "CVE-2025-47291",
  "url": "https://patchblox.com/security/cve/CVE-2025-47291",
  "summary": "CVE-2025-47291 is fixed in containerd on 1 platform by containerd 2.0.5-0ubuntu1 (version 2.0.5-0ubuntu1), released May 21, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.",
  "description": "containerd is an open-source container runtime. A bug was found in the containerd\u0027s CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn\u0027t put usernamespaced containers under the Kubernetes\u0027 cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. This bug has been fixed in containerd 2.0.5\u002B and 2.1.0\u002B. Users should update to these versions to resolve the issue. As a workaround, disable usernamespaced pods in Kubernetes temporarily.",
  "published": "2025-05-21T11:15:00Z",
  "severity": "Moderate",
  "cvss": 7.5,
  "cwe": "Incorrect Privilege Assignment",
  "epss": 0.0029,
  "epssPercentile": 0.21712,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47291",
  "fixes": [
    {
      "platform": "linux",
      "product": "containerd",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "2.0.5-0ubuntu1",
      "fix": "containerd 2.0.5-0ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-containerd-2.0.5-0ubuntu1",
      "released": "2025-05-21T11:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}