KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-9m94-w2vq-hcf9 | KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 07 Nov 2025 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0. | |
| Title | KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation | |
| Weaknesses | CWE-703 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-11-07T22:57:02.600Z
Reserved: 2025-11-03T22:12:51.365Z
Link: CVE-2025-64435
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-07T23:15:45.850
Modified: 2025-11-07T23:15:45.850
Link: CVE-2025-64435
Redhat
No data.
OpenCVE Enrichment
No data.