Skip to content
OpenAdvisories

Package · Alpine

containerd

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.3
    CVE-2026-46680 Public exploit

    containerd user ID handling bypass allows runAsNonRoot evasion

    containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot eva…

    containerd containerd containerd containerd Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2022-23648 Public exploit EPSS 27%

    Insecure handling of image volumes in containerd CRI plugin

    containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image…

    containerd containerd containerd containerd Debian Ubuntu Alpine Go
  • Medium 5.2
    CVE-2020-15257 Public exploit

    containerd-shim API Exposed to Host Network Containers

    containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s AP…

    containerd containerd docker.io docker Debian Ubuntu Alpine Go
  • High 8.1
    CVE-2020-0601 Exploited Public exploit EPSS 89%

    Certificate validation bypass on Windows in crypto/x509

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows Alpine Go
    KEV Nov 3, 2021
  • Unscored —
    CVE-2019-17596 Public exploit

    Panic on invalid DSA public keys in crypto/dsa

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

    go stdlib golang-1.8 golang-1.13 Ubuntu Alpine Go