{"kind": "product", "path": "vulns/debian-14/containerd", "name": "containerd", "product": "containerd", "ecosystem": "Debian:14", "items": [{"id": "CVE-2026-95838", "noindex": false, "published": "2026-10-12T19:53:24.599Z", "modified": "2026-10-13T20:24:33.956Z", "cvss": 4.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00215, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-95838", "title": "containerd: Unpack DoS via repeated opaque whiteouts", "description": "containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4", "https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0", "https://nvd.nist.gov/vuln/detail/CVE-2026-95838"], "fixes": [], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-95837", "noindex": false, "published": "2026-10-12T19:37:49.999Z", "modified": "2026-10-13T17:22:08.473Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00106, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-95837", "title": "containerd CRI plugin: Checkpoint restore bypasses destination security context", "description": "containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in ver", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f", "https://github.com/containerd/containerd/pull/13913", "https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f"], "fixes": [], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53493", "noindex": false, "published": "2026-09-25T00:06:43.298Z", "modified": "2026-09-28T14:58:33.011Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-53493", "title": "Containerd has image-pull DoS via crafted OCI index graph amplification", "description": "containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645", "https://nvd.nist.gov/vuln/detail/CVE-2026-53493"], "fixes": ["2.1.9+ds1-5"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53495", "noindex": false, "published": "2026-09-14T17:18:06.885Z", "modified": "2026-09-14T17:34:38.488Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-53495", "title": "containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service", "description": "containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to te", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv", "https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880c", "https://github.com/containerd/containerd/commit/5a2a3a759b0d2ad8c821b33c3afc20890daf6d81"], "fixes": ["2.1.9+ds1-4"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53489", "noindex": false, "published": "2026-07-01T18:10:41.802Z", "modified": "2026-07-02T14:34:50.018Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "high", "epss": 0.00174, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-53489", "title": "containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore", "description": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388", "https://nvd.nist.gov/vuln/detail/CVE-2026-53489"], "fixes": ["2.1.9+ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53492", "noindex": false, "published": "2026-07-01T17:59:12.552Z", "modified": "2026-07-02T12:50:43.273Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00353, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-53492", "title": "containerd CRI checkpoint restore CDI annotation smuggling", "description": "containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into th", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc", "https://nvd.nist.gov/vuln/detail/CVE-2026-53492"], "fixes": ["2.1.9+ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-50195", "noindex": false, "published": "2026-07-01T17:50:53.072Z", "modified": "2026-07-01T18:32:29.659Z", "cvss": 5.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L", "severity": "medium", "epss": 0.00303, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-50195", "title": "containerd: CRI checkpoint import allows local image tag poisoning", "description": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image inste", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574", "https://nvd.nist.gov/vuln/detail/CVE-2026-50195"], "fixes": ["2.1.9+ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-47262", "noindex": false, "published": "2026-07-01T17:48:43.205Z", "modified": "2026-07-01T18:34:06.714Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00265, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-47262", "title": "containerd image-triggered runtime DoS via unbounded group parsing", "description": "containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq", "https://nvd.nist.gov/vuln/detail/CVE-2026-47262"], "fixes": ["2.1.9+ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-46680", "noindex": false, "published": "2026-07-01T17:40:25.499Z", "modified": "2026-07-03T03:56:06.341Z", "cvss": 7.3, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00163, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-46680", "title": "containerd user ID handling bypass allows runAsNonRoot evasion", "description": "containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w", "https://nvd.nist.gov/vuln/detail/CVE-2026-46680"], "fixes": ["2.1.9+ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2026-53488", "noindex": false, "published": "2026-07-01T00:11:20.610Z", "modified": "2026-07-03T03:56:07.868Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00176, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2026-53488", "title": "containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull", "description": "containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp", "https://nvd.nist.gov/vuln/detail/CVE-2026-53488"], "fixes": ["2.1.9+ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2025-64329", "noindex": false, "published": "2025-11-07T04:15:09.381Z", "modified": "2025-11-07T17:42:07.929Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2025-64329", "title": "containerd CRI server: Host memory exhaustion through Attach goroutine leak", "description": "containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2", "https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df", "https://nvd.nist.gov/vuln/detail/CVE-2025-64329"], "fixes": ["1.7.24~ds1-10"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-25621", "noindex": false, "published": "2025-11-06T18:36:21.566Z", "modified": "2025-11-06T19:35:13.415Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2024-25621", "title": "containerd affected by a local privilege escalation via wide permissions on CRI directory", "description": "containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run ", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w", "https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5", "https://github.com/containerd/containerd/blob/main/docs/rootless.md"], "fixes": ["1.7.24~ds1-9"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2024-40635", "noindex": false, "published": "2025-03-17T21:32:37.894Z", "modified": "2025-05-04T22:02:39.748Z", "cvss": 4.6, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.003, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2024-40635", "title": "containerd has an integer overflow in User ID handling", "description": "containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg", "https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da", "https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20"], "fixes": ["1.7.24~ds1-6"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-25173", "noindex": false, "published": "2023-02-16T14:09:12.073Z", "modified": "2025-03-10T21:10:38.648Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00542, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-25173", "title": "containerd supplementary groups are not set up properly", "description": "containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p", "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4", "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a"], "fixes": ["1.6.18~ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2023-25153", "noindex": false, "published": "2023-02-16T14:09:08.519Z", "modified": "2025-03-10T21:10:44.159Z", "cvss": 6.2, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00363, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2023-25153", "title": "containerd OCI image importer memory exhaustion", "description": "containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18.  Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2", "https://github.com/containerd/containerd/commit/0c314901076a74a7b797a545d2f462285fdbb8c4", "https://github.com/containerd/containerd/releases/tag/v1.5.18"], "fixes": ["1.6.18~ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-23471", "noindex": false, "published": "2022-12-07T22:51:34.193Z", "modified": "2025-04-23T16:31:30.024Z", "cvss": 5.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.01109, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-23471", "title": "containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak", "description": "containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16.  Users should update to these ver", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9", "https://github.com/containerd/containerd/commit/a05d175400b1145e5e6a735a6710579d181e7fb0", "https://security.gentoo.org/glsa/202401-31"], "fixes": ["1.6.12~ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-31030", "noindex": false, "published": "2022-06-06T00:00:00.000Z", "modified": "2024-08-03T07:03:40.336Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00381, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-31030", "title": "containerd CRI plugin: Host memory exhaustion through ExecSync", "description": "containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve t", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf", "https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382", "http://www.openwall.com/lists/oss-security/2022/06/07/1"], "fixes": ["1.6.6~ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-24769", "noindex": false, "published": "2022-03-24T00:00:00.000Z", "modified": "2024-08-03T04:20:49.949Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.00492, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-24769", "title": "Default inheritable capabilities for linux container should be empty", "description": "Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine) prior to version 20.10.14 where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due t", "references": ["https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq", "https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f", "https://github.com/moby/moby/releases/tag/v20.10.14"], "fixes": ["1.6.2~ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2022-23648", "noindex": false, "published": "2022-03-03T00:00:00.000Z", "modified": "2024-08-03T03:51:45.829Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.27392, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2022-23648", "title": "Insecure handling of image volumes in containerd CRI plugin", "description": "containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.1", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7", "https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70", "https://github.com/containerd/containerd/releases/tag/v1.4.13"], "fixes": ["1.6.1~ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}, {"id": "CVE-2021-43816", "noindex": false, "published": "2022-01-05T18:55:10.000Z", "modified": "2025-04-22T18:34:15.666Z", "cvss": 8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "severity": "high", "epss": 0.01682, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}], "path": "vulns/cve-2021-43816", "title": "Improper Preservation of Permissions in containerd", "description": "containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-label which effectively elevates permi", "references": ["https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c", "https://github.com/containerd/containerd/issues/6194", "https://github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eea"], "fixes": ["1.5.9~ds1-1"], "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}]}], "total": 25, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "containerd", "path": "vulns/debian-14/containerd", "ecosystem": "Debian:14"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 3, "kev": 0}, "lastmod": "2026-10-13T20:24:33.956Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}