Skip to content
OpenAdvisories
High ALAS2023-2026-1897 5 CVEs

Important: containerd security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 24, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-53492: Device and host mount injection via CDI annotations in checkpoint metadata (requires CDI enabled on node) NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc CVE-2026-53489: Arbitrary file read on host via symlinked container log paths during checkpoint restore NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 CVE-2026-53488: Arbitrary host command execution through unvalidated image config labels propagated to containers NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp CVE-2026-50195: Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574 CVE-2026-47262: Memory exhaustion DoS causing OOM kill of containerd process NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2023 containerd 0:2.2.4-1.amzn2023.0.3
Amazon Linux · 2023 containerd-debuginfo 0:2.2.4-1.amzn2023.0.3
Amazon Linux · 2023 containerd-debugsource 0:2.2.4-1.amzn2023.0.3
Amazon Linux · 2023 containerd-stress 0:2.2.4-1.amzn2023.0.3
Amazon Linux · 2023 containerd-stress-debuginfo 0:2.2.4-1.amzn2023.0.3

Vulnerabilities 5

  • Critical 9.4
    CVE-2026-53488

    containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

    containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executin…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.4
    CVE-2026-53492

    containerd CRI checkpoint restore CDI annotation smuggling

    containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. W…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 8.2
    CVE-2026-53489

    containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

    containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on t…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.6
    CVE-2026-50195

    containerd: CRI checkpoint import allows local image tag poisoning

    containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attac…

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.3
    CVE-2026-47262

    containerd image-triggered runtime DoS via unbounded group parsing

    containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, …

    containerd containerd zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-47262.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-50195.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53488.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53489.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-53492.html