Vulnerability · Published Oct 12, 2026 · Assigned by GitHub_M
CVE-2026-95838containerd: Unpack DoS via repeated opaque whiteouts
Medium 4.6
In plain English
A medium-severity uncontrolled resource consumption in containerd from containerd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | containerd | no fix listed | DEBIAN-CVE-2026-95838 |
| Debian:13 | containerd | no fix listed | DEBIAN-CVE-2026-95838 |
| Debian:14 | containerd | no fix listed | DEBIAN-CVE-2026-95838 |
| Go | github.com/containerd/containerd | 1.7.35 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd | 1.7.35 | GO-2026-6796 |
| Go | github.com/containerd/containerd/v2 | 2.2.8 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd/v2 | 2.3.5 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd/v2 | 2.0.12 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd/v2 | 2.0.12, 2.2.8, 2.3.5 | GO-2026-6796 |
| Ubuntu:22.04:LTS | containerd | no fix listed | UBUNTU-CVE-2026-95838 |
| Ubuntu:26.10 | containerd | no fix listed | UBUNTU-CVE-2026-95838 |
| Ubuntu:24.04:LTS | containerd-app | no fix listed | UBUNTU-CVE-2026-95838 |
| Ubuntu:26.04:LTS | containerd-app | no fix listed | UBUNTU-CVE-2026-95838 |
| Ubuntu:26.10 | containerd-app | no fix listed | UBUNTU-CVE-2026-95838 |
| Ubuntu:26.04:LTS | containerd-stable | no fix listed | UBUNTU-CVE-2026-95838 |
| Ubuntu:26.10 | containerd-stable | no fix listed | UBUNTU-CVE-2026-95838 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| containerd | containerd | < 1.7.35>= 2.0.0-beta.0, < 2.0.12>= 2.2.0, < 2.2.8>= 2.3.0, < 2.3.5 |
Weakness: CWE-400, CWE-407 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N