CVE Feed

    Dashboard / CVE / CVE-2026-95838

    CVE-2026-95838

    containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

    Published:Oct 12, 2026
    Last Modified:Oct 16, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00215
    CVSS Score:3.3

    Affected Products

    Vendor
    Containerd
    Product
    Containerd

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-95837 (CVSS 7.8) — containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateConta…
    CVE-2026-53493 (CVSS 6.9) — containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a c…
    CVE-2026-53495 (CVSS 6.8) — containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux…
    CVE-2026-53489 (CVSS 8.2) — containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where t…
    CVE-2026-53492 (CVSS 8.4) — containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implement…
    CVE-2026-50195 (CVSS 5.6) — containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerabili…
    CVE-2026-47262 (CVSS 5.3) — containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, cont…
    CVE-2026-46680 (CVSS 7.3) — containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, container…
    CVE-2026-53488 (CVSS 9.4) — containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 t…
    CVE-2025-64329 (CVSS 6.9) — containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-b…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High