Notice of Kubernetes Security Vulnerability (CVE-2025-0426)

CVE-2025-0426 is a DoS vulnerability found in Kubernetes, impacting the kubelet read-only HTTP port. By sending numerous checkpoint requests to the endpoint, an attacker can rapidly fill up the node's disk space, leading to a denial of service on the node.

Vulnerability Details

**Table 1** Vulnerability details
Type	CVE-ID	Severity	Discovered
Denial of service	CVE-2025-0426	Medium	2025-02-13

Impact

This vulnerability affects kubelet of the following versions:

v1.32.0 and v1.32.1
v1.31.0 to v1.31.5
v1.30.0 and v1.30.9

The ContainerCheckpoint feature gate is disabled by default in kubelet v1.25 to v1.29, so the vulnerability will not be activated.

This vulnerability can affect Kubernetes clusters that have the kubelet read-only HTTP port enabled and use a container runtime supporting container checkpointing, such as containerd v2.0 and later or Docker v1.13 and later with Checkpoint/Restore In Userspace (CRIU) enabled.

The containerd versions used by CCE Autopilot clusters are v1.6 and v1.7, and CRIU is not enabled by default, so CCE Autopilot clusters are not affected by this vulnerability.

Identification Method

If the HTTP read-only port of kubelet receives a large number of requests for the /checkpoint interface, an attacker may be exploiting this vulnerability to launch a DoS attack.

Solution

CRIU is not enabled for CCE Autopilot clusters. Therefore, the CVE-2025-0426 vulnerability is not triggered. Do not enable CRIU. In addition, CCE will incorporate the community code to fix this issue in the new version. Keep an eye out for CCE Autopilot Cluster Patch Release History.