CVE-2025-4437
Cri-o: large /etc/passwd file may lead to denial of service
CVE-2025-4437: Cri-o: large /etc/passwd file may lead to denial of service. Not in the CISA KEV catalog. Medium advisory severity (CVSS 5.7, Red Hat).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2025-4437 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- CVSS base score
- 5.7 (Red Hat)
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H(Red Hat)
- Weakness
- CWE-770
- Vendor advisories
- 1 from Red Hat
- VulniPulse record
- Published
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2025-4437; bulletin-wide values are not repeated here.
Is CVE-2025-4437 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2025-4437 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2025-4437?
- As for now there's no available mitigation for this flaw. (Red Hat)
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.7
Medium [CVE-2025-4437] Cri-o: large /etc/passwd file may lead to denial of service
CVE-2025-4437Source published Source updated
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host. This vulnerability was rated as Moderate by the Red Hat's Product Security team as it requires the attacker to own an account with minimal privileges to create pods using the CRI-O utility. Red Hat severity: Moderate — CVSS 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected…
- Affected products in this advisory
- Red Hat OpenShift Container Platform 4
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- As for now there's no available mitigation for this flaw.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.