{"id":"CVE-2026-95838","title":"containerd is an open-source container runtime","summary":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger…","severity":"medium","cvss":4.6,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-400","CWE-407"],"vendor":"containerd","product":"containerd","affected":["containerd < 1.7.35","containerd >= 2.0.0-beta.0, < 2.0.12","containerd >= 2.2.0, < 2.2.8","containerd >= 2.3.0, < 2.3.5"],"patched":["github.com/containerd/containerd/v2 2.0.12","github.com/containerd/containerd 1.7.35","github.com/containerd/containerd/v2 2.2.8","github.com/containerd/containerd/v2 2.3.5"],"published":"2026-10-12","updated":"2026-10-16","sourceUpdated":"2026-10-16T16:00:33.533","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-95838","references":[{"url":"https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0","label":"security-advisories@github.com"},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95838"},{"url":"https://github.com/advisories/GHSA-rp3h-jf77-q9p4"},{"url":"https://github.com/containerd/containerd"}],"tags":["nvd","cve.org","ghsa","go","osv"],"epss":0.00223,"epssPercentile":0.12833,"aliases":["GHSA-rp3h-jf77-q9p4","GO-2026-6796"],"ecosystem":"go","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T20:13:22.924285Z"},"cvssSource":"cna","ingestedAt":"2026-10-12T21:04:28.921Z","slug":"CVE-2026-95838","body":"## Overview\n\ncontainerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-95838)\n\nAffected packages:\n\n- `github.com/containerd/containerd/v2 < 2.0.12`\n- `github.com/containerd/containerd < 1.7.35`\n- `github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.8`\n- `github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.5`\n\nPatched in:\n\n- `github.com/containerd/containerd/v2 2.0.12`\n- `github.com/containerd/containerd 1.7.35`\n- `github.com/containerd/containerd/v2 2.2.8`\n- `github.com/containerd/containerd/v2 2.3.5`\n\nSource: https://github.com/advisories/GHSA-rp3h-jf77-q9p4","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":221167,"id":"CVE-2026-95838","ts":1792030782174,"field":"cvss","old":null,"new":"4.6"},{"seq":221166,"id":"CVE-2026-95838","ts":1792030782174,"field":"severity","old":"none","new":"medium"}]}