CVE-2025-52881 json
runc: LSM labels can be bypassed with malicious config using dummy procfs files
published 2025-11-05 12 mo ago modified 2026-10-07 32 d ago also EUVD-2025-37940 , GHSA-cgrx-mc8f-2prm , GO-2025-4098
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.
Patch / fix
- go github.com/opencontainers/runc 1.2.8, 1.3.3, 1.4.0-rc.3
- go github.com/opencontainers/selinux 1.13.0
- linuxfoundation runc 1.2.8, 1.3.3, 1.4.0-rc.3
- linuxfoundation selinux 1.13.0
- runc Debian 14 1.3.3+ds1-2
debian advisories DEBIAN-CVE-2025-52881
- runc-app Ubuntu 22.04 LTS 1.3.3-0ubuntu1~22.04.2
- runc-app Ubuntu 24.04 LTS 1.3.3-0ubuntu1~24.04.2
- runc-app Ubuntu 25.10 1.3.3-0ubuntu1~25.10.2
- runc-stable Ubuntu 25.10 1.3.3-0ubuntu1~25.10.2
ubuntu advisories UBUNTU-CVE-2025-52881
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- perf openshift 4.15 5.14.0-284.155.1.el9_2
- rtla openshift 4.15 5.14.0-284.155.1.el9_2
- runc openshift 4.16, openshift 4.15, openshift 4.14 +1 more 4:1.2.9-1.rhaos4.16.el8
- runc openshift 4.16, openshift 4.15, openshift 4.14 +1 more 4:1.2.9-1.rhaos4.16.el9
- kernel openshift 4.15 5.14.0-284.155.1.el9_2
- bpftool openshift 4.15 7.0.0-284.155.1.el9_2
- kernel-rt openshift 4.15 5.14.0-284.155.1.rt14.440.el9_2
- kernel-64k openshift 4.15 5.14.0-284.155.1.el9_2
red hat advisories RHSA-2026:1540RHSA-2026:10703RHSA-2026:8325RHSA-2026:4533RHSA-2025:22030RHSA-2026:4693
- podman Linux Micro 6.1 5.4.2-slfo.1.1_6.1
- podman Linux Micro 6.0 4.9.5-12.1
- buildah SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 1.35.5-150500.3.62.1
- buildah SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 1.35.5-150400.3.68.1
- podman Linux Micro 6.1 5.4.2-slfo.1.1_5.1
- podman SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 5.4.2-160000.4.1
- alloy SLES for SAP applications 16.0, SLES 16.0 1.12.2-160000.1.1
- alloy SLE Module for Basesystem 15 SP7 1.12.2-150700.15.15.1
suse advisories SUSE-SU-2026:24378-1SUSE-SU-2026:22516-1SUSE-SU-2026:2733-1SUSE-SU-2026:2706-1SUSE-SU-2026:22451-1SUSE-SU-2026:20626-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- podman openSUSE Leap 16.0 5.4.2-160000.5.1
- podman openSUSE Leap 16.0 5.4.2-160000.4.1
- alloy openSUSE Leap 16.0 1.12.2-160000.1.1
- buildah openSUSE Leap 16.0 1.39.5-160000.1.1
- podman openSUSE Leap 16.0 5.4.2-160000.3.1
- buildah openSUSE Tumbleweed 1.42.2-1.1
- podman openSUSE Tumbleweed 5.7.1-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:21244-1openSUSE-SU-2026:20305-1openSUSE-SU-2026:20140-1openSUSE-SU-2026:20080-1openSUSE-SU-2026:20072-1
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3901+4b80ecd7
- crit AlmaLinux 8 3.18-5.module_el8.10.0+4068+0e21408f
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
- crit AlmaLinux 8 3.18-5.module_el8.10.0+3858+6ad51f9f
- criu AlmaLinux 8 3.18-5.module_el8.10.0+4089+ce72bbbe
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3926+f12484f5
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3876+e55593a8
- criu AlmaLinux 8 3.18-5.module_el8.10.0+3909+6e1c1eb7
almalinux advisories ALSA-2025:23543ALSA-2025:22011ALSA-2025:22012ALSA-2025:21702ALSA-2025:21220ALSA-2025:21232
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1880+8e896d1b
- criu Rocky Linux 8 3.18-5.module+el8.10.0+2001+6a33db9f
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1874+ce489889
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1843+6892ab28
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1896+b18fa106
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1825+623b0c20
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1948+4b5cd4a9
- criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
rocky linux advisories RLSA-2025:23543RLSA-2025:22012RLSA-2025:22011RLSA-2025:21232RLSA-2025:21220RLSA-2025:20957
- runc Alpine 3.24, Alpine 3.23, Alpine 3.22 1.3.3-r0
- podman Alpine 3.22 5.6.2-r1
- podman Alpine 3.24, Alpine 3.23 5.7.0-r0
- buildah Alpine 3.22 1.41.6-r0
- buildah Alpine 3.24, Alpine 3.23 1.42.1-r0
alpine advisories ALPINE-CVE-2025-52881
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- moby-runc CBL-Mariner 2.0 1.2.8-1
- runc Azure Linux 3.0 1.3.3-1
- kubernetes Azure Linux 3.0 1.30.10-18
azure linux advisories AZL-69824AZL-69826AZL-70586
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/opencontainers/runc@ff94f99 commit
- github.com/opencontainers/runc@ff6fe13 commit
- github.com/opencontainers/runc@ed6b169 commit
- github.com/opencontainers/runc@db19bbe commit
- github.com/opencontainers/runc@d61fd29 commit
- github.com/opencontainers/runc@d40b343 commit
- github.com/opencontainers/runc@b3dd1bc commit
- github.com/opencontainers/runc@77d217c commit
- github.com/opencontainers/runc@77889b5 commit
- github.com/opencontainers/runc@6fc1914 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-52881 updated cvss 8.2
runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
-
Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-controller-rhel9affected: workaround, no fix available
-
Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/cluster-logging-rhel9-operatoraffected: workaround, no fix planned “Will not fix”
-
Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/assisted-installer-controller-rhel9 Red Hat OpenShift API for Data Protection oadp/oadp-velero-plugin-rhel8affected: workaround, no fix available
-
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Serverless openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/serverless-must-gather-rhel9, openshift-serverless-1/kn-plugin-func-func-util-rhel9affected: workaround, no fix planned “Will not fix”
-
Red Hat AI Inference Server rhai/base-image-cuda-rhel9, rhai/base-image-rocm-rhel9affected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-26/eda-controller-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Build of Kueue kueue/kueue-must-gather-rhel9affected: workaround, no fix planned “Will not fix”
show 29 moreshow fewer
-
Red Hat Certification Program for Red Hat Enterprise Linux 9 rhcertification/redhat-certification-baremetalaffected: workaround, no fix available
-
Red Hat Enterprise Linux AI (RHEL AI) rhelai1/bootc-gcp-nvidia-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/bootc-azure-cuda-rhel9affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +3 moreaffected: workaround, no fix available
-
Red Hat OpenShift Virtualization 4 cnvnetworking-plugins-rhel9, container-native-virtualization/wasp-agent-rhel9, container-native-virtualization/multus-dynamic-networks-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9, container-native-virtualization/passt-network-binding-plugin-cni-rhel9, container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Quay 3 quay/quay-builder-rhel8affected: workaround, no fix available
-
Red Hat Builds for Red Hat OpenShift 1.6.0 openshift-builds 1.6.2-1767088114, openshift-builds 1.6.2-1767088118fixed: vendor fix RHSA-2026:0050
-
Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hypershift-rhel9-operator 1790168054fixed: vendor fix RHSA-2026:72851
-
Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1771226060fixed: vendor fix RHSA-2026:2900
-
Red Hat OpenShift API for Data Protection 1.4 oadp 1770643554fixed: vendor fix RHSA-2026:2951
-
Red Hat OpenShift API for Data Protection 1.5 oadp 1768602558, oadp 1768627772fixed: vendor fix RHSA-2026:2343
-
Red Hat OpenShift Compliance Operator 1 compliance 1775641344fixed: vendor fix RHSA-2026:8433
-
Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1787860580, rhaiis/vllm-rocm-rhel9 1787884873, rhaiis/model-opt-cuda-rhel9 1787772157fixed: vendor fix RHSA-2026:61628
-
Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+23647+cfd78660, crit 3.18-5.module+el8.10.0+23820+ae6deecc, criu 3.18-5.module+el8.10.0+23647+cfd78660, criu 3.18-5.module+el8.10.0+23820+ae6deecc, runc 1.2.5-2.module+el8.10.0+23647+cfd78660, runc 1.2.9-2.module+el8.10.0+23820+ae6deecc, +60 morefixed: vendor fix RHSA-2025:21232
-
Red Hat Enterprise Linux AppStream (v. 9) runc 1.2.5-3.el9_6, runc 1.3.0-4.el9_7, podman 5.6.0-7.el9_7, buildah 1.41.6-1.el9_7, podman-tests 5.6.0-7.el9_7, podman-docker 5.6.0-7.el9_7, +3 morefixed: vendor fix RHSA-2025:19927
-
Red Hat Enterprise Linux AppStream (v. 10) podman 5.6.0-6.el10_1, buildah 1.41.6-1.el10_1, podman-docker 5.6.0-6.el10_1, podman-remote 5.6.0-6.el10_1, buildah-tests 1.41.6-1.el10_1fixed: vendor fix RHSA-2025:22012
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) crit 3.15-3.module+el8.6.0+24209+25a14987, criu 3.15-3.module+el8.6.0+24209+25a14987, crun 1.14.3-1.module+el8.6.0+24209+25a14987, udica 0.2.6-5.module+el8.6.0+24209+25a14987, conmon 2.1.4-1.module+el8.6.0+24209+25a14987, runc 1.2.9-1.module+el8.6.0+24209+25a14987.1, +27 more Red Hat Enterprise Linux AppStream E4S (v.8.6) crit 3.15-3.module+el8.6.0+24209+25a14987, criu 3.15-3.module+el8.6.0+24209+25a14987, crun 1.14.3-1.module+el8.6.0+24209+25a14987, udica 0.2.6-5.module+el8.6.0+24209+25a14987, conmon 2.1.4-1.module+el8.6.0+24209+25a14987, runc 1.2.9-1.module+el8.6.0+24209+25a14987.1, +27 morefixed: vendor fix RHSA-2026:10703
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) crit 3.15-4.module+el8.8.0+23884+2031fc78, criu 3.15-4.module+el8.8.0+23884+2031fc78, runc 1.2.9-1.module+el8.8.0+23884+2031fc78, crun 1.14.3-1.module+el8.8.0+23884+2031fc78, conmon 2.1.6-1.module+el8.8.0+23884+2031fc78, udica 0.2.6-20.module+el8.8.0+23884+2031fc78, +27 morefixed: vendor fix RHSA-2026:4693
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) runc 1.2.9-1.el9_0, podman 4.2.0-6.el9_0.6, buildah 1.26.9-1.el9_0.3, podman-tests 4.2.0-6.el9_0.6, podman-docker 4.2.0-6.el9_0.6, podman-remote 4.2.0-6.el9_0.6, +4 morefixed: vendor fix RHSA-2026:8325
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) runc 1.2.9-1.el9_2.1, podman 4.4.1-22.el9_2.5, buildah 1.29.5-1.el9_2.2, podman-tests 4.4.1-22.el9_2.5, buildah-tests 1.29.5-1.el9_2.2, podman-docker 4.4.1-22.el9_2.5, +3 morefixed: vendor fix RHSA-2026:4532
-
Red Hat Enterprise Linux AppStream EUS (v. 10.0) podman 5.4.0-14.el10_0, buildah 1.39.5-1.el10_0, buildah-tests 1.39.5-1.el10_0, podman-docker 5.4.0-14.el10_0, podman-remote 5.4.0-14.el10_0fixed: vendor fix RHSA-2025:21633
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) runc 1.2.9-1.el9_4, podman 4.9.4-19.el9_4.5, buildah 1.33.13-2.el9_4.1, podman-tests 4.9.4-19.el9_4.5, podman-docker 4.9.4-19.el9_4.5, podman-remote 4.9.4-19.el9_4.5, +2 morefixed: vendor fix RHSA-2026:0426
-
Red Hat Enterprise Linux AppStream EUS (v.9.6) podman 5.4.0-15.el9_6, buildah 1.39.5-1.el9_6, podman-tests 5.4.0-15.el9_6, buildah-tests 1.39.5-1.el9_6, podman-docker 5.4.0-15.el9_6, podman-remote 5.4.0-15.el9_6, +1 morefixed: vendor fix RHSA-2025:21634
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) crit 3.15-3.module+el8.6.0+24209+25a14987, criu 3.15-3.module+el8.6.0+24209+25a14987, crun 1.14.3-1.module+el8.6.0+24209+25a14987, udica 0.2.6-5.module+el8.6.0+24209+25a14987, conmon 2.1.4-1.module+el8.6.0+24209+25a14987, runc 1.2.9-1.module+el8.6.0+24209+25a14987.1, +27 morefixed: vendor fix RHSA-2026:10703
-
Red Hat Enterprise Linux AppStream TUS (v.8.8) crit 3.15-4.module+el8.8.0+23884+2031fc78, criu 3.15-4.module+el8.8.0+23884+2031fc78, runc 1.2.9-1.module+el8.8.0+23884+2031fc78, crun 1.14.3-1.module+el8.8.0+23884+2031fc78, conmon 2.1.6-1.module+el8.8.0+23884+2031fc78, udica 0.2.6-20.module+el8.8.0+23884+2031fc78, +27 morefixed: vendor fix RHSA-2026:4693
-
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests 5.6.0-6.el10_1fixed: vendor fix RHSA-2025:21220
-
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) podman-tests 5.4.0-14.el10_0fixed: vendor fix RHSA-2025:23347
-
Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-controller-rhel8 1783953372fixed: vendor fix RHSA-2026:41928
-
Red Hat OpenShift AI 2.25 rhoai 1770053703, rhoai 1770053721, rhoai 1770053723, rhoai 1770053728, rhoai 1770053730, rhoai 1770053733, +19 morefixed: vendor fix RHSA-2026:2106
-
Red Hat OpenShift AI 3.3 rhoai 1769162595, rhoai 1770788873, rhoai 1771415661, rhoai 1771420581, rhoai 1771502843, rhoai 1771502844, +14 morefixed: vendor fix RHSA-2026:3713
21 more fixed, 54 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 12 mo ago
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.3 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 7.3 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/opencontainers/runc | <1.2.8 >=1.3.0-rc.1, <1.3.3 >=1.4.0-rc.1, <1.4.0-rc.3 |
1.2.8 1.3.3 1.4.0-rc.3 |
| go | github.com/opencontainers/selinux | <1.13.0 |
1.13.0 |
Affected products
- opencontainers runc
Classification
References
-
github.com
/opencontainers/runc/commit/ff94f9991bd32076c871ef0ad8bc1b763458e480
web, patch
-
github.com
/opencontainers/runc/commit/ff6fe1324663538167eca8b3d3eec61e1bd4fa51
web, patch
-
github.com
/opencontainers/runc/commit/ed6b1693b8b3ae7eb0250a7e76fc888cdacf98c1
web, patch
-
github.com
/opencontainers/runc/commit/db19bbed5348847da433faa9d69e9f90192bfa64
web, patch
-
github.com
/opencontainers/runc/commit/d61fd29d854b416feaaf128bf650325cd2182165
web, patch
-
github.com
/opencontainers/runc/commit/d40b3439a9614a86e87b81a94c6811ec6fa2d7d2
web, patch
-
github.com
/opencontainers/runc/commit/b3dd1bc562ed9996d1a0f249e056c16624046d28
web, patch
-
github.com
/opencontainers/runc/commit/77d217c7c3775d8ca5af89e477e81568ef4572db
web, patch
-
github.com
/opencontainers/runc/commit/77889b56db939c323d29d1130f28f9aea2edb544
web, patch
-
github.com
/opencontainers/runc/commit/6fc191449109ea14bb7d61238f24a33fe08c651f
web, patch
-
github.com
/opencontainers/runc/commit/4b37cd93f86e72feac866442988b549b5b7bf3e6
web, patch
-
github.com
/opencontainers/runc/commit/44a0fcf685db051c80b8c269812bb177f5802c58
web, patch
-
github.com
/opencontainers/runc/commit/435cc81be6b79cdec73b4002c0dae549b2f6ae6d
web, patch
-
github.com
/opencontainers/runc/commit/3f925525b44d247e390e529e772a0dc0c0bc3557
web, patch
-
github.com
/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
web, patch
-
github.com
/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
web, patch
-
github.com
/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm
web, exploit, mitigation, patch, third-party-advisory, advisory
-
github.com
/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r
web, patch, third-party-advisory
-
github.com
/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
web, patch, third-party-advisory
-
github.com
/opencontainers/runc/blob/v1.4.0-rc.2/RELEASES.md
web, patch
-
github.com
/opencontainers/selinux/pull/237
web, patch
-
github.com
/opencontainers/runc/commit/fdcc9d3cad2f85954a241ccb910a61aaa1ef47f3
web, patch
-
github.com
/opencontainers/runc/commit/a41366e74080fa9f26a2cd3544e2801449697322
web, patch
-
github.com
/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-52881
advisory
-
youtu.be
/tGseJW_uBB8
web
-
pkg.go.dev
/github.com/cyphar/filepath-securejoin/pathrs-lite/procfs
web
-
youtu.be
/y1PaBzxwRWQ
web
-
github.com
/opencontainers/selinux/releases/tag/v1.13.0
web
-
github.com
/opencontainers/runc
package
Sources
- CVE List CVE-2025-52881
- GitHub Advisory GHSA-cgrx-mc8f-2prm
- NVD CVE-2025-52881
- OSV GO-2025-4098
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.