{"id":"EUVD-2026-97822","enisaUuid":"1ffbd845-772c-30fe-ba73-d13fd6c9adf8","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd\u0027s layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","datePublished":"Oct 12, 2026, 7:53:24 PM","dateUpdated":"Oct 13, 2026, 8:24:33 PM","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4\nhttps://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0\n","aliases":"CVE-2026-95838\nGHSA-rp3h-jf77-q9p4\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"26482652-1f1a-3234-8c89-4f0e1a94bcd4","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003c 1.7.35"},{"id":"3e4c1880-2644-3fec-9390-1465d4589c38","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.3.0, \u003c 2.3.5"},{"id":"e0b9c689-6b44-392b-9de2-0b3324d19cf4","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.0.0-beta.0, \u003c 2.0.12"},{"id":"f6c200ed-e2f5-3e14-8ff1-6a7ca8dcb02d","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.2.0, \u003c 2.2.8"}],"enisaIdVendor":[{"id":"1b3a48d8-e9f3-3f58-8892-a005ecd40c36","vendor":{"name":"containerd"}}],"enisaIdVulnerability":[{"id":"2861bd8f-c4f4-3b24-9b25-a1fac5d9d1be","vulnerability":{"id":"CVE-2026-95838","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd\u0027s layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","datePublished":"Oct 12, 2026, 7:53:24 PM","dateUpdated":"Oct 13, 2026, 8:24:33 PM","status":"PUBLISHED","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4\nhttps://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0\n","enisa_id":"EUVD-2026-97822\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 28, 2026, 7:20:13 AM","vulnerabilityProduct":[{"id":"1e35bb38-fb1a-3aaa-89f2-debab77da987","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.0.0-beta.0, \u003c 2.0.12"},{"id":"2d4d5e32-8e38-3e74-8b57-73d5d7ff71a1","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003c 1.7.35"},{"id":"a972c064-26d1-3cfc-98f6-3cf667132255","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.2.0, \u003c 2.2.8"},{"id":"b4a2bfb1-426f-39e1-ad90-dc142ac4d403","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.3.0, \u003c 2.3.5"}],"vulnerabilityVendor":[{"id":"4034bbb4-4bd0-3277-b716-2395937c1a80","vendor":{"name":"containerd"}}]}},{"id":"8be9815f-516e-3655-b3d4-076614fdbfa1","vulnerability":{"id":"GHSA-rp3h-jf77-q9p4","description":"containerd: Unpack DoS via repeated opaque whiteouts","datePublished":"Oct 15, 2026, 8:22:05 PM","dateUpdated":"Oct 15, 2026, 8:22:05 PM","baseScore":0.0,"references":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-95838\nhttps://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0\nhttps://github.com/containerd/containerd\n","enisa_id":"EUVD-2026-97822\n","aliases":"GHSA-rp3h-jf77-q9p4\nCVE-2026-95838\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"5ae3cc32-87ad-3500-8185-ffb0a47245f8","advisory":{"id":"msrc_CVE-2026-95838","description":"containerd: Unpack DoS via repeated opaque whiteouts","datePublished":"Oct 14, 2026, 2:55:04 AM","dateUpdated":"Oct 24, 2026, 2:48:15 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-95838.json\n","aliases":"CVE-2026-95838\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"075d13c4-7a78-3620-b430-42ad4c2965af","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"15e96043-757a-32db-945b-a1256985e2a1","product":{"name":"kata-containers","vendor":{"name":"kata-containers"}}},{"id":"6691202c-1af3-304c-aad0-7477d906d06f","product":{"name":"kata-containers-cc","vendor":{"name":"Microsoft"}}},{"id":"96839eef-036e-3079-a912-61fc4088c9f0","product":{"name":"containerd2","vendor":{"name":"Microsoft"}}},{"id":"bfe16cd5-dcfe-3970-a486-5d3561f83cc5","product":{"name":"moby-engine","vendor":{"name":"Microsoft"}}},{"id":"c1fa8b29-b2d6-34c3-b4c7-ff8b571739d8","product":{"name":"moby-containerd-cc","vendor":{"name":"Microsoft"}}},{"id":"c9c54b70-4787-3b2a-8762-ce0a629994da","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"e7cf2929-3f74-36db-bd97-6fcce904882a","product":{"name":"azl3 containerd2 0:2.3.4-1.azl3","vendor":{"name":"Microsoft"}}}]}},{"id":"749fd883-926e-3dfa-8510-e28574afa4cd","advisory":{"id":"openSUSE-SU-2026:12152-1","description":"google-osconfig-agent-20261015.00-1.1 on GA media","summary":"google-osconfig-agent-20261015.00-1.1 on GA media","datePublished":"Oct 16, 2026, 12:00:00 AM","dateUpdated":"Oct 17, 2026, 9:17:47 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12152-1.json\nhttps://www.suse.com/security/cve/CVE-2026-61801/\nhttps://www.suse.com/security/cve/CVE-2026-78669/\nhttps://www.suse.com/security/cve/CVE-2026-95838/\n","aliases":"CVE-2026-61801\nCVE-2026-78669\nCVE-2026-95838\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"322cae3a-4956-3e2d-ac37-e492f257b347","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"70688bca-f8ac-3403-af34-37964ab8cc72","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7ab23fd5-6091-36c7-b688-91d517bbcb93","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"9e193e2a-78c4-3a60-b879-18abdd8f536c","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"ce2f92a0-d28c-382a-8b83-dbd553677bde","product":{"name":"google-osconfig-agent-0:20261015.00-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}