CVE-2025-0426: Node Denial of Service via kubelet Checkpoint API

February 13, 2025 (updated December 20, 2025)

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node’s disk.

References

github.com/advisories/GHSA-jgfp-53c3-624w
github.com/kubernetes/kubernetes
github.com/kubernetes/kubernetes/issues/130016
groups.google.com/g/kubernetes-security-announce/c/KiODfu8i6w8
nvd.nist.gov/vuln/detail/CVE-2025-0426

Code Behaviors & Features

Detect and mitigate CVE-2025-0426 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →