CVE-2026-95838
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
- CVSS 4.0
- 4.6
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)
- CWEs
- CWE-400, CWE-407
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rp3h-jf77-q9p4 | Go | github.com/containerd/containerd/v2 | <2.0.12 | 2.0.12 |
| GHSA-rp3h-jf77-q9p4 | Go | github.com/containerd/containerd | <1.7.35 | 1.7.35 |
| GHSA-rp3h-jf77-q9p4 | Go | github.com/containerd/containerd/v2 | >=2.2.0 <2.2.8 | 2.2.8 |
| GHSA-rp3h-jf77-q9p4 | Go | github.com/containerd/containerd/v2 | >=2.3.0 <2.3.5 | 2.3.5 |
| GO-2026-6796 | Go | github.com/containerd/containerd | <1.7.35 | 1.7.35 |
| GO-2026-6796 | Go | github.com/containerd/containerd/v2 | <2.0.12 >=2.2.0 <2.2.8 >=2.3.0 <2.3.5 | 2.0.12, 2.2.8, 2.3.5 |