OESA-2026-4568

Dashboard / Vulnerabilities / OESA-2026-4568

OESA-2026-4568

Summary: containerd security update

Details: containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc. Security Fix(es): containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.(CVE-2026-95838)

References: https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4568, https://nvd.nist.gov/vuln/detail/CVE-2026-95838