{"id":"CVE-2025-4437","revision":"e46e58ee91cb40c5b4ccb32029c1c907","records":[{"revision":"e46e58ee91cb40c5b4ccb32029c1c907","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-4437","aliases":[],"title":"Cri-o: large /etc/passwd file may lead to denial of service","description":"There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host.","state":0,"publishedAt":"2025-08-20T12:19:18.453+00:00","modifiedAt":"2026-09-01T11:51:10.231+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"cri-o","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"cri-o\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift/ose-rhel-coreos-8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift/ose-rhel-coreos-8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"openshift/ose-rhel-coreos-9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat OpenShift Container Platform 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"openshift/ose-rhel-coreos-9\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:openshift:4\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","score":5.7,"severity":"MEDIUM"}],"references":["https://access.redhat.com/security/cve/CVE-2025-4437","https://bugzilla.redhat.com/show_bug.cgi?id=2375084"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-4437","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-4437","identifiers":["CVE-2025-4437"]},"retained":false,"historicalAffected":[]}],"coverage":[]}