{"id":"EUVD-2026-97822","revision":"e97f0c321dfa4293a188e7d3b7b325bb","records":[{"revision":"e97f0c321dfa4293a188e7d3b7b325bb","observedAt":"2026-11-07T15:26:49.799+00:00","statement":{"source":"euvd","id":"EUVD-2026-97822","aliases":["CVE-2026-95838","GHSA-rp3h-jf77-q9p4"],"title":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger re…","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":4.6,"severity":null}],"references":["https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4","https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97822","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 12, 2026, 7:53:24 PM","dateUpdated":"Oct 13, 2026, 8:24:33 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:24374-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-61801","CVE-2026-78669","CVE-2026-95838"]},{"id":"SUSE-SU-2026:24381-1","title":"Security update for containerd","vulnerabilityIds":["CVE-2026-39882","CVE-2026-47262","CVE-2026-53488","CVE-2026-53493","CVE-2026-53495","CVE-2026-95838"]},{"id":"msrc_CVE-2026-95838","title":"containerd: Unpack DoS via repeated opaque whiteouts","vulnerabilityIds":["CVE-2026-95838"]},{"id":"SUSE-SU-2026:4923-1","title":"Security update for containerd","vulnerabilityIds":["CVE-2026-39882","CVE-2026-47262","CVE-2026-53493","CVE-2026-53495","CVE-2026-95838"]},{"id":"openSUSE-SU-2026:12297-1","title":"kubectl-retina-1.3.1-1.1 on GA media","vulnerabilityIds":["CVE-2024-51744","CVE-2025-22872","CVE-2025-27144","CVE-2025-30204","CVE-2025-54410","CVE-2025-58190","CVE-2026-33186","CVE-2026-34986","CVE-2026-53941","CVE-2026-72815","CVE-2026-95838"]},{"id":"openSUSE-SU-2026:12152-1","title":"google-osconfig-agent-20261015.00-1.1 on GA media","vulnerabilityIds":["CVE-2026-61801","CVE-2026-78669","CVE-2026-95838"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-97822","identifiers":["EUVD-2026-97822","CVE-2026-95838","GHSA-rp3h-jf77-q9p4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}