CVE-2025-52881 is being reported by Wiz on the latest AMI

[surajmali14]

Image I'm using: : bottlerocket-aws-k8s-1.33-x86_64-v1.62.1-ea1afdd6

What I expected to happen: : CVE-2025-52881 should not be present in the latest AMI version, as it has already been addressed in the corresponding release.

What actually happened: I found that CVE-2025-52881 has already been fixed in Bottlerocket AMI v1.50.0. Since we are already using the latest Bottlerocket AMI version, it is unexpected that Wiz is still reporting this vulnerability.

According to the Bottlerocket release notes, the fix is included in v1.50.0:
https://github.com/bottlerocket-os/bottlerocket/releases/tag/v1.50.0

Could you please help verify whether this is a false positive, or if there is an updated vulnerability database or additional remediation required?

How to reproduce the problem: : Images for reference

[jeferson-wurz]

Hi team,

Any updates or findings regarding this issue?

Since CVE-2025-52881 was addressed in Bottlerocket v1.50.0 (via the updated runc package), could you confirm if Wiz reporting this on the latest AMI (v1.62.1) is a false positive from their scanner database, or if there's any residual file triggering the detection?

Thanks!

[denniskern]

I believe the issue is still present in Bottlerocket version 1.62.x. It is related to the tap binary, which is part of the CNI plugins package. Bottlerocket uses CNI plugins version 1.9.0 in this release, while the fix was introduced in version 1.9.1.