CVE-2025-64435: KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

November 6, 2025 (updated November 17, 2025)

_Short summary of the problem. Make the impact and severity as clear as possible.

A logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service).

References

github.com/advisories/GHSA-9m94-w2vq-hcf9
github.com/kubevirt/kubevirt
github.com/kubevirt/kubevirt/commit/9a6f4a3a707992038ef705da4cb3bba8c89d36ba
github.com/kubevirt/kubevirt/security/advisories/GHSA-9m94-w2vq-hcf9
nvd.nist.gov/vuln/detail/CVE-2025-64435

Code Behaviors & Features

Detect and mitigate CVE-2025-64435 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →