Description
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| containerd | containerd | < 1.7.35, >= 2.0.0-beta.0, < 2.0.12, >= 2.2.0, < 2.2.8, >= 2.3.0, < 2.3.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | containerd | No fix yet | — |
| Debian 13 | containerd | No fix yet | — |
| Debian 12 | containerd | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | containerd +2 | No fix yet | — |
| Ubuntu 26.04 LTS | containerd-app +1 | No fix yet | — |
| Ubuntu 24.04 LTS | containerd-app | No fix yet | — |
| Ubuntu 22.04 LTS | containerd | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | containerd | No fix yet | — |
| Ubuntu Pro 24.04 LTS | containerd | No fix yet | — |
| Ubuntu Pro 22.04 LTS | containerd-app | No fix yet | — |
| Ubuntu Pro 20.04 LTS | containerd +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | containerd | No fix yet | — |
| Ubuntu Pro 16.04 LTS | containerd | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
| SLES 12 SP5 | containerd | 1.7.29-16.119.1 | SUSE-SU-2026:4923-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | containerd | 1.7.29-slfo.1.1_5.1 | SUSE-SU-2026:24381-1 |
| SLE Micro 6.0 | google-osconfig-agent | 20261015.00-159998.1.1 | SUSE-SU-2026:24374-1 |
| SLE Micro 5.5 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
| SLE Micro 5.4 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
| SLE Micro 5.3 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | containerd | 2.4.2-1.1 | openSUSE-SU-2026:12342-1 |
| openSUSE Tumbleweed | google-osconfig-agent | 20261015.00-1.1 | openSUSE-SU-2026:12152-1 |
| openSUSE Tumbleweed | kubectl-retina | 1.3.1-1.1 | openSUSE-SU-2026:12297-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | containerd2 | 2.3.7-1 | — |
| Azure Linux 3 | moby-containerd-cc | 1.7.7-19 | — |
| Azure Linux 3 | moby-engine +3 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containerd/containerd | < 1.7.35 | 1.7.35 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd/v2 | < 2.0.12 | 2.0.12 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd/v2 | >= 2.2.0, < 2.2.8 | 2.2.8 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd/v2 | >= 2.3.0, < 2.3.5 | 2.3.5 | GHSA-rp3h-jf77-q9p4 |
| Go | github.com/containerd/containerd/v2 | < 2.0.12 · >= 2.2.0, < 2.2.8 · >= 2.3.0, < 2.3.5 | 2.0.12, 2.2.8, 2.3.5 | GO-2026-6796 |
Advisories 7
- SUSE-SU-2026:5201-1 Security update for containerd SUSE / openSUSE Security Updates · Nov 12, 2026
- openSUSE-SU-2026:12342-1 containerd-2.4.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026
- openSUSE-SU-2026:12297-1 kubectl-retina-1.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Oct 28, 2026
- SUSE-SU-2026:4923-1 Security update for containerd SUSE / openSUSE Security Updates · Oct 28, 2026
- SUSE-SU-2026:24381-1 Security update for containerd SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24374-1 Security update for google-osconfig-agent SUSE / openSUSE Security Updates · Oct 27, 2026
- openSUSE-SU-2026:12152-1 google-osconfig-agent-20261015.00-1.1 on GA media SUSE / openSUSE Security Updates · Oct 17, 2026