What’s Vulnerable › Vulnerabilities

CVE-2025-64435: KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-07 · updated 2026-06-17
• Weakness: CWE-703

Description

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.

Affected products

• kubevirt: through 1.6.3; 1.7.0-alpha0

References

• https://github.com/kubevirt/kubevirt/commit/9a6f4a3a707992038ef705da4cb3bba8c89d36ba
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-9m94-w2vq-hcf9

Get alerted when CVE-2025-64435 or the next vulnerability affects your stack