{"id":"EUVD-2026-97822","enisaUuid":"1ffbd845-772c-30fe-ba73-d13fd6c9adf8","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd\u0027s layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","datePublished":"Oct 12, 2026, 7:53:24 PM","dateUpdated":"Oct 13, 2026, 8:24:33 PM","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4\nhttps://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0\n","aliases":"CVE-2026-95838\nGHSA-rp3h-jf77-q9p4\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"26482652-1f1a-3234-8c89-4f0e1a94bcd4","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003c 1.7.35"},{"id":"3e4c1880-2644-3fec-9390-1465d4589c38","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.3.0, \u003c 2.3.5"},{"id":"e0b9c689-6b44-392b-9de2-0b3324d19cf4","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.0.0-beta.0, \u003c 2.0.12"},{"id":"f6c200ed-e2f5-3e14-8ff1-6a7ca8dcb02d","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.2.0, \u003c 2.2.8"}],"enisaIdVendor":[{"id":"1b3a48d8-e9f3-3f58-8892-a005ecd40c36","vendor":{"name":"containerd"}}],"enisaIdVulnerability":[{"id":"2861bd8f-c4f4-3b24-9b25-a1fac5d9d1be","vulnerability":{"id":"CVE-2026-95838","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd\u0027s layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","datePublished":"Oct 12, 2026, 7:53:24 PM","dateUpdated":"Oct 13, 2026, 8:24:33 PM","status":"PUBLISHED","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4\nhttps://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0\n","enisa_id":"EUVD-2026-97822\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 30, 2026, 7:20:46 AM","vulnerabilityProduct":[{"id":"1e35bb38-fb1a-3aaa-89f2-debab77da987","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.0.0-beta.0, \u003c 2.0.12"},{"id":"2d4d5e32-8e38-3e74-8b57-73d5d7ff71a1","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003c 1.7.35"},{"id":"a972c064-26d1-3cfc-98f6-3cf667132255","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.2.0, \u003c 2.2.8"},{"id":"b4a2bfb1-426f-39e1-ad90-dc142ac4d403","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.3.0, \u003c 2.3.5"}],"vulnerabilityVendor":[{"id":"4034bbb4-4bd0-3277-b716-2395937c1a80","vendor":{"name":"containerd"}}]}},{"id":"8be9815f-516e-3655-b3d4-076614fdbfa1","vulnerability":{"id":"GHSA-rp3h-jf77-q9p4","description":"containerd: Unpack DoS via repeated opaque whiteouts","datePublished":"Oct 15, 2026, 8:22:05 PM","dateUpdated":"Oct 15, 2026, 8:22:05 PM","baseScore":0.0,"references":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-95838\nhttps://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0\nhttps://github.com/containerd/containerd\n","enisa_id":"EUVD-2026-97822\n","aliases":"GHSA-rp3h-jf77-q9p4\nCVE-2026-95838\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"3c17f33f-469c-3a84-80c4-2ae8e1a01c0a","advisory":{"id":"SUSE-SU-2026:24374-1","description":"Security update for google-osconfig-agent","summary":"Security update for google-osconfig-agent","datePublished":"Oct 26, 2026, 6:59:50 AM","dateUpdated":"Oct 27, 2026, 1:10:58 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24374-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624374-1/\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624374-1/\nhttps://bugzilla.suse.com/1284870\nhttps://bugzilla.suse.com/1285135\nhttps://bugzilla.suse.com/1285283\nhttps://www.suse.com/security/cve/CVE-2026-61801/\nhttps://www.suse.com/security/cve/CVE-2026-78669/\nhttps://www.suse.com/security/cve/CVE-2026-95838/\n","aliases":"CVE-2026-61801\nCVE-2026-78669\nCVE-2026-95838\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"8a8e607d-3e8f-3681-af75-e00d398b4b2d","product":{"name":"google-osconfig-agent-0:20261015.00-159998.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"cf18fc77-1e73-31dd-a587-2dadc94a74e7","product":{"name":"google-osconfig-agent-0:20261015.00-159998.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"f9046a44-04ec-3152-b21c-071a8d5332c6","product":{"name":"google-osconfig-agent-0:20261015.00-159998.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"fe18625e-e80e-3d39-9128-8aad4e80c944","product":{"name":"SUSE Linux Micro 6.0","vendor":{"name":"SUSE"}}}]}},{"id":"49634495-8496-3555-b1a7-ae0d069c6c4c","advisory":{"id":"SUSE-SU-2026:24381-1","description":"Security update for containerd","summary":"Security update for containerd","datePublished":"Oct 23, 2026, 8:05:50 AM","dateUpdated":"Oct 27, 2026, 1:11:05 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_24381-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624381-1/\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202624381-1/\nhttps://bugzilla.suse.com/1268430\nhttps://bugzilla.suse.com/1268441\nhttps://bugzilla.suse.com/1274214\nhttps://bugzilla.suse.com/1280007\nhttps://bugzilla.suse.com/1282669\nhttps://bugzilla.suse.com/1285124\nhttps://www.suse.com/security/cve/CVE-2026-39882/\nhttps://www.suse.com/security/cve/CVE-2026-47262/\nhttps://www.suse.com/security/cve/CVE-2026-53488/\nhttps://www.suse.com/security/cve/CVE-2026-53493/\nhttps://www.suse.com/security/cve/CVE-2026-53495/\nhttps://www.suse.com/security/cve/CVE-2026-95838/\n","aliases":"CVE-2026-39882\nCVE-2026-47262\nCVE-2026-53488\nCVE-2026-53493\nCVE-2026-53495\nCVE-2026-95838\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"41309754-1efe-3055-af2e-ebf041b04c2c","product":{"name":"SUSE Linux Micro 6.1","vendor":{"name":"SUSE"}}},{"id":"4b3dcdfe-74bf-31e8-9054-67d394ad6ffa","product":{"name":"containerd-0:1.7.29-slfo.1.1_5.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6f10a8e0-7a9e-3331-a6aa-123158905e88","product":{"name":"containerd-0:1.7.29-slfo.1.1_5.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"73d65fa8-3bda-3303-9da0-a4fbbcca0241","product":{"name":"containerd-0:1.7.29-slfo.1.1_5.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d117f026-8ed7-3d39-b0ad-cfd51e12e9d2","product":{"name":"containerd-0:1.7.29-slfo.1.1_5.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"5ae3cc32-87ad-3500-8185-ffb0a47245f8","advisory":{"id":"msrc_CVE-2026-95838","description":"containerd: Unpack DoS via repeated opaque whiteouts","datePublished":"Oct 14, 2026, 2:55:04 AM","dateUpdated":"Oct 24, 2026, 2:48:15 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-95838.json\n","aliases":"CVE-2026-95838\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"075d13c4-7a78-3620-b430-42ad4c2965af","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"15e96043-757a-32db-945b-a1256985e2a1","product":{"name":"kata-containers","vendor":{"name":"kata-containers"}}},{"id":"6691202c-1af3-304c-aad0-7477d906d06f","product":{"name":"kata-containers-cc","vendor":{"name":"Microsoft"}}},{"id":"96839eef-036e-3079-a912-61fc4088c9f0","product":{"name":"containerd2","vendor":{"name":"Microsoft"}}},{"id":"bfe16cd5-dcfe-3970-a486-5d3561f83cc5","product":{"name":"moby-engine","vendor":{"name":"Microsoft"}}},{"id":"c1fa8b29-b2d6-34c3-b4c7-ff8b571739d8","product":{"name":"moby-containerd-cc","vendor":{"name":"Microsoft"}}},{"id":"c9c54b70-4787-3b2a-8762-ce0a629994da","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"e7cf2929-3f74-36db-bd97-6fcce904882a","product":{"name":"azl3 containerd2 0:2.3.4-1.azl3","vendor":{"name":"Microsoft"}}}]}},{"id":"5c87c465-c0c5-3e1c-b5e5-3de4c4b0bc71","advisory":{"id":"SUSE-SU-2026:4923-1","description":"Security update for containerd","summary":"Security update for containerd","datePublished":"Oct 27, 2026, 5:09:41 PM","dateUpdated":"Oct 28, 2026, 11:17:38 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4923-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-20264923-1/\nhttps://www.suse.com/support/update/announcement/2026/suse-su-20264923-1/\nhttps://bugzilla.suse.com/1268441\nhttps://bugzilla.suse.com/1274214\nhttps://bugzilla.suse.com/1280007\nhttps://bugzilla.suse.com/1282669\nhttps://bugzilla.suse.com/1285124\nhttps://www.suse.com/security/cve/CVE-2026-39882/\nhttps://www.suse.com/security/cve/CVE-2026-47262/\nhttps://www.suse.com/security/cve/CVE-2026-53493/\nhttps://www.suse.com/security/cve/CVE-2026-53495/\nhttps://www.suse.com/security/cve/CVE-2026-95838/\n","aliases":"CVE-2026-39882\nCVE-2026-47262\nCVE-2026-53493\nCVE-2026-53495\nCVE-2026-95838\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"1b0c4764-aad8-3d95-bda2-55e2c949fda6","product":{"name":"SUSE Linux Enterprise Server for SAP Applications 12 SP5","vendor":{"name":"SUSE"}}},{"id":"29ce8bd5-8552-3d13-bbc9-3df9181a0706","product":{"name":"containerd-devel-0:1.7.29-16.119.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"30444cf5-f362-309d-885b-ca98b78dbdb7","product":{"name":"containerd-devel-0:1.7.29-16.119.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"50234867-46f2-3888-a6f1-ddd7a8801b33","product":{"name":"containerd-devel-0:1.7.29-16.119.1.i586","vendor":{"name":"SUSE"}}},{"id":"603a3349-8fc2-3370-a73f-c365152e7bc3","product":{"name":"containerd-ctr-0:1.7.29-16.119.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"605e481c-5eab-3f5c-aff5-77622052e3ec","product":{"name":"containerd-ctr-0:1.7.29-16.119.1.s390x","vendor":{"name":"SUSE"}}},{"id":"6c9a0616-1852-330d-86b4-265f351dbdca","product":{"name":"containerd-ctr-0:1.7.29-16.119.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"95f11b17-8bd7-3a4d-8c8a-4182bce567df","product":{"name":"containerd-0:1.7.29-16.119.1.s390x","vendor":{"name":"SUSE"}}},{"id":"9623064a-da9f-35c4-8119-0f2a27b053ea","product":{"name":"containerd-0:1.7.29-16.119.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"97bcd49c-d49f-3781-ad2c-74f112058b07","product":{"name":"containerd-ctr-0:1.7.29-16.119.1.i586","vendor":{"name":"SUSE"}}},{"id":"b86d8622-5593-3eed-8c96-184190765f35","product":{"name":"containerd-0:1.7.29-16.119.1.i586","vendor":{"name":"SUSE"}}},{"id":"ba511cf4-242e-301e-ae11-28c78d95fff8","product":{"name":"SUSE Linux Enterprise High Performance Computing 12 SP5","vendor":{"name":"SUSE"}}},{"id":"c625ad27-e4dc-3340-bb20-65931de2f3df","product":{"name":"SUSE Linux Enterprise Server 12 SP5","vendor":{"name":"SUSE"}}},{"id":"d852f1fe-a9bc-3882-afff-d590d632d7d9","product":{"name":"containerd-ctr-0:1.7.29-16.119.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"de354a09-eea3-32fa-9c4e-ed35e7dad25a","product":{"name":"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","vendor":{"name":"SUSE"}}},{"id":"e2532f5c-a6c2-374c-a149-c391ef9a4ef3","product":{"name":"containerd-0:1.7.29-16.119.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"e3d749a3-ed71-31db-a819-b95808b25bd3","product":{"name":"containerd-devel-0:1.7.29-16.119.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e6b82970-84cc-39c4-b912-1fe5eb4d1493","product":{"name":"containerd-0:1.7.29-16.119.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"fededca4-ba67-3c00-a286-061c4f2c9e4b","product":{"name":"containerd-devel-0:1.7.29-16.119.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"6a50e67d-45ca-348d-acde-cad9c32e9df2","advisory":{"id":"openSUSE-SU-2026:12297-1","description":"kubectl-retina-1.3.1-1.1 on GA media","summary":"kubectl-retina-1.3.1-1.1 on GA media","datePublished":"Oct 27, 2026, 12:00:00 AM","dateUpdated":"Oct 28, 2026, 11:19:25 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12297-1.json\nhttps://www.suse.com/security/cve/CVE-2024-51744/\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-27144/\nhttps://www.suse.com/security/cve/CVE-2025-30204/\nhttps://www.suse.com/security/cve/CVE-2025-54410/\nhttps://www.suse.com/security/cve/CVE-2025-58190/\nhttps://www.suse.com/security/cve/CVE-2026-33186/\nhttps://www.suse.com/security/cve/CVE-2026-34986/\nhttps://www.suse.com/security/cve/CVE-2026-53941/\nhttps://www.suse.com/security/cve/CVE-2026-72815/\nhttps://www.suse.com/security/cve/CVE-2026-95838/\n","aliases":"CVE-2024-51744\nCVE-2025-22872\nCVE-2025-27144\nCVE-2025-30204\nCVE-2025-54410\nCVE-2025-58190\nCVE-2026-33186\nCVE-2026-34986\nCVE-2026-53941\nCVE-2026-72815\nCVE-2026-95838\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"2812187c-b3d6-3a85-b7a4-92942626088a","product":{"name":"kubectl-retina-0:1.3.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"33ae9e77-e99d-32ff-88f3-c32d782d8951","product":{"name":"kubectl-retina-0:1.3.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"3d153b7b-92ad-3fe2-aa1c-291965ed83a1","product":{"name":"kubectl-retina-0:1.3.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4e0eb690-758b-3a5b-b36b-51c3df6ca139","product":{"name":"kubectl-retina-zsh-completion-0:1.3.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"505de098-e6ea-3a69-b51c-089b9ba1a343","product":{"name":"kubectl-retina-zsh-completion-0:1.3.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6ea94811-a109-3e23-8534-b966920f358d","product":{"name":"kubectl-retina-bash-completion-0:1.3.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"75335a29-d28e-34ee-85f0-14ef8eac36bf","product":{"name":"kubectl-retina-0:1.3.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"94b63362-10ea-32a9-ae5f-9a1984e94ffd","product":{"name":"kubectl-retina-fish-completion-0:1.3.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"af35e941-add4-3aa9-9a3b-781d9f2f8e6e","product":{"name":"kubectl-retina-zsh-completion-0:1.3.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"cccc1d61-e2d9-3597-8182-cc402e17ed89","product":{"name":"kubectl-retina-bash-completion-0:1.3.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"da836244-d450-3729-82fd-5e22027a0d7a","product":{"name":"kubectl-retina-bash-completion-0:1.3.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"dc25e57b-47ad-3d3f-b9ea-aa9806c5d798","product":{"name":"kubectl-retina-bash-completion-0:1.3.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"dc474e74-887b-399f-aa95-ab6d12ef3795","product":{"name":"kubectl-retina-zsh-completion-0:1.3.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"ea9bf3c6-1591-3371-93fe-46ee1f7c75f6","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"efad3d16-58f3-3978-830b-6249677e6bd0","product":{"name":"kubectl-retina-fish-completion-0:1.3.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f7844122-04e8-3db6-a841-f17a0e68f177","product":{"name":"kubectl-retina-fish-completion-0:1.3.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f91c3751-3a87-329e-8a48-ef5f8ca57327","product":{"name":"kubectl-retina-fish-completion-0:1.3.1-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"749fd883-926e-3dfa-8510-e28574afa4cd","advisory":{"id":"openSUSE-SU-2026:12152-1","description":"google-osconfig-agent-20261015.00-1.1 on GA media","summary":"google-osconfig-agent-20261015.00-1.1 on GA media","datePublished":"Oct 16, 2026, 12:00:00 AM","dateUpdated":"Oct 17, 2026, 9:17:47 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12152-1.json\nhttps://www.suse.com/security/cve/CVE-2026-61801/\nhttps://www.suse.com/security/cve/CVE-2026-78669/\nhttps://www.suse.com/security/cve/CVE-2026-95838/\n","aliases":"CVE-2026-61801\nCVE-2026-78669\nCVE-2026-95838\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"322cae3a-4956-3e2d-ac37-e492f257b347","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"70688bca-f8ac-3403-af34-37964ab8cc72","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7ab23fd5-6091-36c7-b688-91d517bbcb93","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"9e193e2a-78c4-3a60-b879-18abdd8f536c","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"ce2f92a0-d28c-382a-8b83-dbd553677bde","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}