Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-47262 EUVD-2026-41106GHSA-jpcc-p29g-p8mqGO-2026-5475

containerd image-triggered runtime DoS via unbounded group parsing

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by GitHub_M

Vendor: containerd Product: containerd Package: buildctl Package: buildkitd Package: chartmuseum Package: cluster-api-helm-controller Package: consul-k8s-1.9-cli Package: containerd Package: containerd Package: containerd Package: containerd-app Package: containerd-stable Package: containerd2 Package: ctop Package: dagger Package: datadog-agent-7.72 Package: datadog-agent-7.73 Package: datadog-agent-7.77 Package: datadog-agent-7.78 Package: datadog-agent-7.79 Package: datadog-agent-7.80 Package: docker-cli-buildx Package: docker-compose Package: dockerd-28 Package: dockerd-29 Package: dogstatsd-7.72 Package: dogstatsd-7.73 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: dogstatsd-7.79 Package: dogstatsd-7.80 Package: eksctl Package: envoy-gateway-egctl Package: falco-no-driver Package: fuse-overlayfs-snapshotter Package: github.com/containerd/containerd Package: github.com/containerd/containerd/v2 Package: grype Package: headlamp Package: helm-3 Package: helm-mapkubeapis Package: helm-operator Package: helm-push Package: helm-set-status Package: k3s-static Package: k3s-static-1.34 Package: k3s-static-1.35 Package: k8sgpt Package: k8ssandra-client Package: k9s Package: kaniko Package: kaniko-warmer Package: kargo Package: kots Package: kube-arangodb-1.4 Package: kubescape Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: linkerd2-cli Package: linkerd2-controller Package: linkerd2-controller-compat Package: linkerd2-debug Package: linkerd2-metrics-api Package: linkerd2-tap Package: linkerd2-web Package: manifest-tool Package: moby-containerd-cc Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-infrastructure-agent Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-helm-3 Package: scorecard Package: skaffold Package: spegel Package: steampipe Package: syft Package: teleport-18.6 Package: tigera-operator-1.42 Package: trivy Package: trivy-operator Package: tw Package: twt Package: wolfictl Package: xeol Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.

Affected products

VendorProductAffectedFixed
containerd containerd >= 1.7.0, < 1.7.33, >= 2.0.0, < 2.0.10, >= 2.1.0, < 2.1.9, >= 2.2.0, < 2.2.5, >= 2.3.0, < 2.3.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 containerd 2.1.9+ds1-1 —
Debian 13 containerd No fix yet —
Debian 12 containerd No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 containerd No fix yet —
Ubuntu 26.04 LTS containerd-app +1 2.2.2-0ubuntu1.1 —
Ubuntu 25.10 containerd No fix yet —
Ubuntu 25.10 containerd-app 2.2.1-0ubuntu1~25.10.2 —
Ubuntu 25.10 containerd-stable 2.1.6-0ubuntu1~25.10.2 —
Ubuntu 24.04 LTS containerd-app 2.2.1-0ubuntu1~24.04.3 —
Ubuntu 22.04 LTS containerd 1.6.12-0ubuntu1~22.04.11 —
Ubuntu 22.04 LTS containerd-app 2.2.1-0ubuntu1~22.04.2 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS containerd 1.7.24~ds1-10ubuntu1+esm1 —
Ubuntu Pro 24.04 LTS containerd 1.6.24~ds1-1ubuntu1.3+esm3 —
Ubuntu Pro 20.04 LTS containerd 1.6.12-0ubuntu1~20.04.8+esm2 —
Ubuntu Pro 20.04 LTS containerd-app 1.7.24-0ubuntu1~20.04.2+esm2 —
Ubuntu Pro 18.04 LTS containerd 1.6.12-0ubuntu1~18.04.1+esm4 —
Ubuntu Pro 16.04 LTS containerd 1.2.6-0ubuntu1~16.04.6+esm7 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 grype 0.115.0-0.1.hum1 RHSA-2026:32963
Red Hat Hardened Images 1 kubernetes1.35 +3 1.35.6-1.hum1 RHSA-2026:25535
Red Hat Hardened Images 1 kubernetes1.36 +3 1.36.2-2.hum1 RHSA-2026:26990
Red Hat Hardened Images 1 opentelemetry-collector-contrib 0.155.0-0.1.hum1 RHSA-2026:29770
Red Hat Hardened Images 1 syft 1.46.0-0.1.hum1 RHSA-2026:32974
Red Hat Hardened Images 1 trivy 0.72.0-0.1.hum1 RHSA-2026:35111

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1
SLES 12 SP5 containerd 1.7.29-16.119.1 SUSE-SU-2026:4923-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 containerd 1.7.29-slfo.1.1_5.1 SUSE-SU-2026:24381-1
SLE Micro 5.5 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1
SLE Micro 5.4 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1
SLE Micro 5.3 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed containerd 1.7.33-1.1 openSUSE-SU-2026:11107-1
openSUSE Tumbleweed trivy 0.71.2-1.1 openSUSE-SU-2026:11102-1
openSUSE Leap 16.0 containerd 1.7.33-160000.1.1 openSUSE-SU-2026:21213-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 16.0 trivy 0.71.2-160000.1.1 openSUSE-SU-2026:21072-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 containerd 2.3.2-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 containerd +1 2.2.4-1.amzn2023.0.3 ALAS2023-2026-1897
Amazon Linux 2023 docker 25.0.18-1.amzn2023.0.1 ALAS2023-2026-3266
Amazon Linux 2023 nerdctl 2.3.5-1.amzn2023.0.1 ALAS2023-2026-2129
Amazon Linux 2023 runfinch-finch 1.19.0-1.amzn2023.0.1 ALAS2023-2026-3140
Amazon Linux 2 nerdctl 2.3.5-1.amzn2.0.1 ALAS2-2026-3903

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 containerd2 2.2.4-3 —
Azure Linux 3 moby-containerd-cc 1.7.7-19 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling buildctl +1 0.31.0-r2 —
Wolfi rolling chartmuseum 0.16.5-r13 —
Wolfi rolling cluster-api-helm-controller 0.6.4-r7 —
Wolfi rolling consul-k8s-1.9-cli 1.9.8-r5 —
Wolfi rolling ctop 0.7.7-r37 —
Wolfi rolling dagger 0.20.8-r9 —
Wolfi rolling docker-cli-buildx 0.35.0-r1 —
Wolfi rolling docker-compose 5.1.4-r6 —
Wolfi rolling dockerd-28 No fix yet —
Wolfi rolling dockerd-29 29.6.0-r1 —
Wolfi rolling dogstatsd-7.72 +1 7.72.4-r31 —
Wolfi rolling dogstatsd-7.73 +1 7.73.3-r23 —
Wolfi rolling dogstatsd-7.77 +1 7.77.3-r17 —
Wolfi rolling dogstatsd-7.78 +1 7.78.4-r12 —
Wolfi rolling dogstatsd-7.79 +1 7.79.2-r5 —
Wolfi rolling dogstatsd-7.80 +1 7.80.4-r1 —
Wolfi rolling eksctl 0.227.0-r5 —
Wolfi rolling envoy-gateway-egctl 1.8.1-r2 —
Wolfi rolling falco-no-driver 0.45.0-r0 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r17 —
Wolfi rolling grype 0.114.0-r1 —
Wolfi rolling headlamp 0.43.0-r1 —
Wolfi rolling helm-3 3.21.2-r1 —
Wolfi rolling helm-mapkubeapis 0.6.1-r21 —
Wolfi rolling helm-operator 1.42.2-r13 —
Wolfi rolling helm-push 0.11.1-r16 —
Wolfi rolling helm-set-status 0.3.0-r20 —
Wolfi rolling k3s-static 1.36.2.1-r1 —
Wolfi rolling k3s-static-1.34 1.34.9.1-r1 —
Wolfi rolling k3s-static-1.35 1.35.6.1-r1 —
Wolfi rolling k8sgpt 0.4.34-r1 —
Wolfi rolling k8ssandra-client 0.9.1-r2 —
Wolfi rolling k9s 0.51.0-r1 —
Wolfi rolling kaniko +1 1.25.15-r9 —
Wolfi rolling kargo 1.10.7-r1 —
Wolfi rolling kots 1.130.4-r8 —
Wolfi rolling kube-arangodb-1.4 1.4.3-r11 —
Wolfi rolling kubescape 4.0.9-r1 —
Wolfi rolling kubescape-operator 0.2.151-r1 —
Wolfi rolling kubevela-vela-cli +1 1.10.8-r11 —
Wolfi rolling linkerd2-cli +4 26.6.3-r2 —
Wolfi rolling linkerd2-debug +1 26.9.2-r0 —
Wolfi rolling manifest-tool 2.2.2-r4 —
Wolfi rolling neuvector-scanner +1 4.199-r1 —
Wolfi rolling newrelic-infrastructure-agent 1.76.2-r1 —
Wolfi rolling rancher-2.13 2.13.6-r4 —
Wolfi rolling rancher-2.14 2.14.2-r2 —
Wolfi rolling rancher-agent-2.13 2.13.6-r2 —
Wolfi rolling rancher-agent-2.14 2.14.2-r3 —
Wolfi rolling rancher-helm-3 3.20.0-r15 —
Wolfi rolling scorecard 5.5.0-r9 —
Wolfi rolling skaffold 2.22.0-r2 —
Wolfi rolling spegel 0.7.2-r2 —
Wolfi rolling steampipe 2.4.4-r6 —
Wolfi rolling syft 1.45.1-r1 —
Wolfi rolling teleport-18.6 18.6.8-r23 —
Wolfi rolling tigera-operator-1.42 1.42.2-r1 —
Wolfi rolling trivy 0.70.0-r7 —
Wolfi rolling trivy-operator 0.30.1-r16 —
Wolfi rolling tw +1 0.0.49-r2 —
Wolfi rolling wolfictl 0.39.18-r2 —
Wolfi rolling xeol 0.10.8-r46 —
Wolfi rolling zarf 0.79.0-r1 —
Wolfi rolling zot 2.1.17-r7 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/containerd/containerd >= 1.7.0, < 1.7.33 1.7.33 GHSA-jpcc-p29g-p8mq
Go github.com/containerd/containerd/v2 >= 2.0.0, < 2.0.10 2.0.10 GHSA-jpcc-p29g-p8mq
Go github.com/containerd/containerd/v2 >= 2.1.0, < 2.1.9 2.1.9 GHSA-jpcc-p29g-p8mq
Go github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.5 2.2.5 GHSA-jpcc-p29g-p8mq
Go github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.2 2.3.2 GHSA-jpcc-p29g-p8mq
Go github.com/containerd/containerd/v2 >= 2.0.0, < 2.0.10 · >= 2.1.0, < 2.1.9 · >= 2.2.0, < 2.2.5 · >= 2.3.0, < 2.3.2 2.0.10, 2.1.9, 2.2.5, 2.3.2 GO-2026-5475

Advisories 20

References