runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively). This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:19927 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
      * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
      * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19927 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-19927 advisory.

    - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-078 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3950-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252232).
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252232).
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252232).

    Update to runc v1.2.7.

    - Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.2.7>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3951-1 advisory.

    - CVE-2025-31133: Fixed container escape via 'masked path' abuse due to mount race conditions     (bsc#1252232).
    - CVE-2025-52565: Fixed container escape with malicious config due to /dev/console mount and related races     (bsc#1252232).
    - CVE-2025-52881: Fixed container escape and denial of service due to arbitrary write gadgets and procfs     write redirects (bsc#1252232).

    Update to runc v1.2.7.

    - Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.2.7>

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-072 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.3.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-077 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1263 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7851-1 advisory.

    Lei Wang and Li Fubang discovered that runC incorrectly handled masked paths. An attacker could possibly     replace a container's /dev/null with a symlink to some other procfs file and possibly escape a container.
    (CVE-2025-31133)

    Lei Wang and Li Fubang discovered that runC incorrectly handled the /dev/console bind-mounts. An attacker     could potentially exploit this issue to build-mount a symlink and escape a container. (CVE-2025-52565)

    Li Fubang and Tnis Tiigi discovered that the fix for CVE-2019-16884 was incomplete. An attacker could     possibly use this issue to cause a denial of service or escape the container. (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6a0f63aaab advisory.

    Automatic update for runc-1.3.3-1.fc44.

    ##### **Changelog**

    ```
    * Wed Nov  5 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 2:1.3.3-1
    - Update to release v1.3.3
    - Resolves: rhbz#2411664, rhbz#2411410, rhbz#2411148
    - Resolves: rbhz#2410768, rhbz#2410512, rhbz#2410233
    - Resolves: rhbz#2409818, rhbz#2409561, rhbz#2409284
    - Resolves: rhbz#2408345, rhbz#2408091, rhbz#2407818
    - Security. Fixes CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
    - Upstream new feature

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. (CVE-2025-52565)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
274618	AlmaLinux 9 : runc (ALSA-2025:19927)	Nessus	Alma Linux Local Security Checks	high
274606	RHEL 9 : runc (RHSA-2025:19927)	Nessus	Red Hat Local Security Checks	high
274585	Oracle Linux 9 : runc (ELSA-2025-19927)	Nessus	Oracle Linux Local Security Checks	high
274502	Amazon Linux 2 : runc, --advisory ALAS2DOCKER-2025-078 (ALASDOCKER-2025-078)	Nessus	Amazon Linux Local Security Checks	high
274485	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : runc (SUSE-SU-2025:3950-1)	Nessus	SuSE Local Security Checks	high
274484	SUSE SLES12 Security Update : runc (SUSE-SU-2025:3951-1)	Nessus	SuSE Local Security Checks	high
274467	Amazon Linux 2 : runc, --advisory ALAS2NITRO-ENCLAVES-2025-072 (ALASNITRO-ENCLAVES-2025-072)	Nessus	Amazon Linux Local Security Checks	high
274409	Amazon Linux 2 : runc, --advisory ALAS2ECS-2025-077 (ALASECS-2025-077)	Nessus	Amazon Linux Local Security Checks	high
274404	Amazon Linux 2023 : runc (ALAS2023-2025-1263)	Nessus	Amazon Linux Local Security Checks	high
274388	Ubuntu 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : runC vulnerabilities (USN-7851-1)	Nessus	Ubuntu Local Security Checks	high
274068	Fedora 44 : runc (2025-6a0f63aaab)	Nessus	Fedora Local Security Checks	high
272310	Linux Distros Unpatched Vulnerability : CVE-2025-52565	Nessus	Misc.	high

Detections

Analytics

CVE-2025-52565

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high