CO
Product
containerd
15
CVEs
0
On KEV
9.9
Max CVSS
2
New 30D
Severity mix
Critical 2High 6Medium 7Low 0
Watch
Add containerd to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-50195 | 9.9 | Jul 1 | containerd: CRI checkpoint import allows local image tag poisoning Affected: >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 |
| CVE-2026-53492 | 9.6 | Jul 1 | containerd CRI checkpoint restore CDI annotation smuggling Affected: >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 |
| CVE-2026-53488 | 8.8 | Jul 1 | containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull Affected: < 1.7.33; >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 |
| CVE-2026-95837 | 7.8 | Oct 12 | containerd CRI plugin: Checkpoint restore bypasses destination security context Affected: >= 2.1.0, < 2.2.7; >= 2.3.0, < 2.3.4 |
| CVE-2026-46680 | 7.8 | Jul 1 | containerd user ID handling bypass allows runAsNonRoot evasion Affected: < 1.7.32; >= 2.0.4, < 2.0.9; >= 2.0.10, < 2.2.4; >= 2.2.5, < 2.3.1 |
| CVE-2024-25621 | 7.8 | Nov 6 | containerd affected by a local privilege escalation via wide permissions on CRI directory Affected: < 1.7.29; >= 2.0.0-beta.0, < 2.0.7; >= 2.1.0-beta.0, < 2.1.5; >= 2.2.0-beta.0, < 2.2.0 |
| CVE-2024-40635 | 7.8 | Mar 17 | containerd has an integer overflow in User ID handling Affected: < 1.6.38; >= 1.7.0-beta.0, < 1.7.27; >= 2.0.0-beta.0, < 2.0.4 |
| CVE-2025-47291 | 7.5 | May 21 | containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. Affected: >= 2.0.1, < 2.0.5 |
| CVE-2026-53493 | 6.9 | Sep 25 | Containerd has image-pull DoS via crafted OCI index graph amplification Affected: >= 2.0.0, < 2.0.13; < 1.7.36; >= 2.1.0, < 2.2.9; >= 2.3.0, < 2.3.6; = 2.4.0 |
| CVE-2026-53495 | 6.8 | Sep 14 | containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service Affected: < 1.7.35; >= 2.0.0, < 2.0.12; >= 2.2.0, < 2.2.8; >= 2.3.0, < 2.3.5 |
| CVE-2026-53489 | 6.5 | Jul 1 | containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore Affected: >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 |
| CVE-2025-47290 | 5.9 | May 20 | Containerd vulnerable to host filesystem access during image unpack Affected: = 2.1.0 |
| CVE-2026-47262 | 5.5 | Jul 1 | containerd image-triggered runtime DoS via unbounded group parsing Affected: >= 1.7.0, < 1.7.33; >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 |
| CVE-2025-64329 | 5.5 | Nov 7 | containerd CRI server: Host memory exhaustion through Attach goroutine leak Affected: < 1.7.29; < 2.0.7; >= 2.1.0-beta.0, < 2.1.5; >= 2.2.0-beta.0, < 2.2.0 |
| CVE-2026-95838 | 4.6 | Oct 12 | containerd: Unpack DoS via repeated opaque whiteouts Affected: < 1.7.35; >= 2.0.0-beta.0, < 2.0.12; >= 2.2.0, < 2.2.8; >= 2.3.0, < 2.3.5 |
Showing 15