{"id":"GO-2026-6796","revision":"8833430fc1ea4535a82a779ec5f4bbdf","records":[{"revision":"8833430fc1ea4535a82a779ec5f4bbdf","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6796","aliases":["CVE-2026-95838","GHSA-rp3h-jf77-q9p4"],"title":"containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd","description":"containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd","state":0,"publishedAt":"2026-10-19T21:08:35+00:00","modifiedAt":"2026-10-19T21:31:38.3059973+00:00","affected":[{"ecosystem":"Go","name":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.7.35"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.12"},{"kind":"introduced","version":"2.2.0"},{"kind":"fixed","version":"2.2.8"},{"kind":"introduced","version":"2.3.0"},{"kind":"fixed","version":"2.3.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4","https://nvd.nist.gov/vuln/detail/CVE-2026-95838","https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6796","license":"OSV · upstream source license applies","key":"osv:GO-2026-6796","identifiers":["GO-2026-6796","CVE-2026-95838","GHSA-rp3h-jf77-q9p4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}