What’s Vulnerable › Products

containerd vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your containerd version is affected

Latest containerd vulnerabilities

• CVE-2026-95838 — containerd: Unpack DoS via repeated opaque whiteouts (CVSS 4.6)
• CVE-2026-95837 — containerd CRI plugin: Checkpoint restore bypasses destination security context (CVSS 7.8)
• CVE-2026-53493 — Containerd has image-pull DoS via crafted OCI index graph amplification (CVSS 6.9)
• CVE-2026-53495 — containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service (CVSS 6.8)
• CVE-2026-53492 — containerd CRI checkpoint restore CDI annotation smuggling (CVSS 9.6)
• CVE-2026-53489 — containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore (CVSS 6.5)
• CVE-2026-50195 — containerd: CRI checkpoint import allows local image tag poisoning (CVSS 9.9)
• CVE-2026-47262 — containerd image-triggered runtime DoS via unbounded group parsing (CVSS 5.5)
• CVE-2026-46680 — containerd user ID handling bypass allows runAsNonRoot evasion (CVSS 7.8)
• CVE-2026-53488 — containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull (CVSS 8.8)
• CVE-2025-64329 — containerd CRI server: Host memory exhaustion through Attach goroutine leak (CVSS 5.5)
• CVE-2024-25621 — containerd affected by a local privilege escalation via wide permissions on CRI directory (CVSS 7.8)
• CVE-2025-47291 — containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (CVSS 7.5)
• CVE-2025-47290 — Containerd vulnerable to host filesystem access during image unpack (CVSS 5.9)
• CVE-2024-40635 — containerd has an integer overflow in User ID handling (CVSS 7.8)
• CVE-2023-25173 — containerd supplementary groups are not set up properly (CVSS 7.8)
• CVE-2023-25153 — containerd OCI image importer memory exhaustion (CVSS 5.5)
• CVE-2022-23471 — containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak (CVSS 6.5)
• CVE-2022-31030 — containerd CRI plugin: Host memory exhaustion through ExecSync (CVSS 5.5)
• CVE-2022-23648 — Insecure handling of image volumes in containerd CRI plugin (CVSS 7.5)
• CVE-2021-43816 — Improper Preservation of Permissions in containerd (CVSS 9.1)
• CVE-2021-41103 — Insufficiently restricted permissions on plugin directories (CVSS 7.8)
• CVE-2021-32760 — Archive package allows chmod of file outside of unpack target directory (CVSS 6.3)
• CVE-2021-21334 — environment variable leak (CVSS 6.3)
• CVE-2020-15257 — containerd-shim API Exposed to Host Network Containers (CVSS 5.2)