Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-95838 · GHSA-rp3h-jf77-q9p4

containerd: Unpack DoS via repeated opaque whiteouts

Risk score
40/100
CVSS
4.6 v4.0
Exploit chance (30 days)
0.2%
Published
12 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or im…
Affected
github.com/containerd/containerd/v2 (go) < 2.0.12; github.com/containerd/containerd (go) < 1.7.35; github.com/containerd/containerd/v2 (go) >= 2.2.0, < 2.2.8; github.com/containerd/containerd/v2 (go) >= 2.3.0, < 2.3.5
Fix
Upgrade github.com/containerd/containerd/v2 to 2.0.12 or 2.2.8 or 2.3.5; github.com/containerd/containerd to 1.7.35 (whichever matches your release line) or later.
Exploitation
No known exploitation

Story map

Story map: github.com/containerd/containerd/v2THE FLAWSTHE FIXCVE-2026-95838Containerd: Unpack DoS viarepeated opaque whiteoutsCVSS 4.6 · EPSS 0%CVE-2026-95837Containerd CRI plugin:Checkpoint restore bypassesdestination security contextCVSS 7.8 · EPSS 0%CVE-2026-53493Containerd has image-pull DoSvia crafted OCI index graphamplificationCVSS 6.9 · EPSS 0%Upgrade…1.7.35 · 2.0.12 · 2.2.8 · 2.3.5 ·2.2.7 · 2.3.4or later on your release lineWho is exposedgithub.com/containerd/containerd/v2 (go) >= 2.1.0, < 2.2.7;github.com/containerd/containerd/v2 (go) >= 2.3.0, < 2.3.4YELLOW · PLAN IT INgithub.com/containerd/containerd…containerd is an open-sourcecontainer runtime. From 2.1.0until 2.2.7 and 2.3.4,containerd's CRICreateContainer checkpointrestore is vulnerable becauseCRIU restores process…Where it standsNo known exploitationCONNECTS TOSame weaknessDenial of service (CWE-400)255 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/containerd/containerd/v2: Yellow, plan it in. containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a craft…

The flaws

  • CVE-2026-95838: Containerd: Unpack DoS via repeated opaque whiteouts (CVSS 4.6 · EPSS 0%)
  • CVE-2026-95837: Containerd CRI plugin: Checkpoint restore bypasses destination security context (CVSS 7.8 · EPSS 0%)
  • CVE-2026-53493: Containerd has image-pull DoS via crafted OCI index graph amplification (CVSS 6.9 · EPSS 0%)

The fix

Upgrade github.com/containerd/containerd/v2: 1.7.35 · 2.0.12 · 2.2.8 · 2.3.5 · 2.2.7 · 2.3.4 or later on your release line

Who is exposed: github.com/containerd/containerd/v2 (go) >= 2.1.0, < 2.2.7; github.com/containerd/containerd/v2 (go) >= 2.3.0, < 2.3.4

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 4.6 medium
  • On your watchlist: containerd, Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/containerd/containerd/v2go< 2.0.122.0.12
github.com/containerd/containerdgo< 1.7.351.7.35
github.com/containerd/containerd/v2go>= 2.2.0, < 2.2.82.2.8
github.com/containerd/containerd/v2go>= 2.3.0, < 2.3.52.3.5

References

Original description

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

Last activity 12 Oct 2026. Patch Forecast updates every hour.