opencontainers has 7 CVEs on record between 2021 and 2026. The median CVSS is 5.0 (medium). None have a confirmed exploitation report. Most affected products: github.com/opencontainers/runc (4), github.com/opencontainers/distribution-spec (1), github.com/opencontainers/image-spec (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.0
- Publish → KEV
- —
- Last 90 days
- 0 prev 1
Products
- github.com/opencontainers/runc 4
- github.com/opencontainers/distribution-spec 1
- github.com/opencontainers/image-spec 1
- github.com/opencontainers/umoci 1
Worst active — by depth score
CVE-2021-30465High· 7.6mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs44CVE-2021-43784Medium· 6.0Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC33CVE-2021-29136Medium· 5.5Improper input validation in umoci30CVE-2019-19921Medium· 5.0opencontainers runc contains procfs race condition with a shared volume mount28CVE-2026-41579Medium· 3.3runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations 18
opencontainers vulnerabilities
CVEs affecting opencontainers, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-41579Medium· 3.3runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
CVE-2021-29136Medium· 5.5Improper input validation in umoci
Improper input validation in umoci
CVE-2021-43784Medium· 6.0Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC
Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC
GHSA-77vh-xpmg-72qhLow· 3.0Clarify `mediaType` handling
Clarify `mediaType` handling
CVE-2021-41190Low· 3.0Clarify Content-Type handling
Clarify Content-Type handling
CVE-2019-19921Medium· 5.0opencontainers runc contains procfs race condition with a shared volume mount
opencontainers runc contains procfs race condition with a shared volume mount
CVE-2021-30465High· 7.6mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs
mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs