PatchTheCVEgvisor vulnerabilities and fixes
Recent CVEs affecting gvisor, with upgrade or downgrade steps. 3 tracked.
gvisor has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2025-03-28. Highest priority: CVE-2024-10603 (score 33/100).
- CVE-2025-2713 HIGH 7.8 UPGRADE Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling
- CVE-2024-10603 MEDIUM 5.3 UPGRADE Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed t
- CVE-2024-10026 MEDIUM 5.3 UPGRADE A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to
FAQ
How do I fix gvisor vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gvisor being exploited right now?
None of the tracked gvisor CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gvisor CVE should I patch first?
CVE-2024-10603 currently ranks highest (33/100): Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed t.