{"cve":"CVE-2026-95838","nvd":{"published":"2026-10-12T20:17:10.577","modified":"2026-10-16T16:00:33.533","status":"Awaiting Analysis","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":4.6},"cvss_v3":null,"cwes":["CWE-400","CWE-407"],"references":["https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0","https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:52.678897993+00:00"},"epss":{"cve":"CVE-2026-95838","score":0.00223,"percentile":0.12794,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-rp3h-jf77-q9p4","url":"https://osv.dev/vulnerability/GHSA-rp3h-jf77-q9p4","summary":"containerd: Unpack DoS via repeated opaque whiteouts","modified":"2026-10-19T21:40:52.337183596Z","packages":[{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":["<2.0.12"],"fixed":["2.0.12"]},{"ecosystem":"Go","name":"github.com/containerd/containerd","purl":"pkg:golang/github.com/containerd/containerd","ranges":["<1.7.35"],"fixed":["1.7.35"]},{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":[">=2.2.0 <2.2.8"],"fixed":["2.2.8"]},{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":[">=2.3.0 <2.3.5"],"fixed":["2.3.5"]}]},{"id":"GO-2026-6796","url":"https://osv.dev/vulnerability/GO-2026-6796","summary":"containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd","modified":"2026-10-19T21:31:38.305997328Z","packages":[{"ecosystem":"Go","name":"github.com/containerd/containerd","purl":"pkg:golang/github.com/containerd/containerd","ranges":["<1.7.35"],"fixed":["1.7.35"]},{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":["<2.0.12",">=2.2.0 <2.2.8",">=2.3.0 <2.3.5"],"fixed":["2.0.12","2.2.8","2.3.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}