CVE-2026-95838— containerd: Unpack DoS via repeated opaque whiteouts
Quick assessment
Affected
containerd containerd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
containerd 是一个开源的容器运行时。在版本 1.7.35、2.0.12、2.2.8 和 2.3.5 之前，containerd 的层解包处理器在处理某些不透明白文件（opaque whiteout）配置时，会反复遍历目录。恶意构造的镜像层可以在处理不透明白文件时触发重复的目录遍历操作。拉取或导入此类镜像可能导致 CPU 资源被大量消耗、容器启动延迟，并降低与其他无关部署相关的镜像拉取并发能力。该问题已在版本 1.7.35、2.0.12、2.2.8 和 2.3.5 中得到修复。
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| containerd | containerd | < 1.7.35 |
affected |
>= 2.0.0-beta.0, < 2.0.12 |
affected | ||
>= 2.2.0, < 2.2.8 |
affected | ||
>= 2.3.0, < 2.3.5 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95838
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
containerd: Unpack DoS via repeated opaque whiteouts
Source: CVE Program / CVE List V5
Vulnerability Description
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| containerd | containerd | < 1.7.35 | - |
|
II. Public POCs for CVE-2026-95838
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95838
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-95838 (1)
Vendor Advisories for CVE-2026-95838 (1)
IV. Related Vulnerabilities
Same product: containerd
-
CVE-2026-95837
containerd CRI plugin: Checkpoint restore bypasses destinati -
CVE-2026-53493
Containerd has image-pull DoS via crafted OCI index graph am -
CVE-2026-53495
containerd CRI ExecSync Goroutine Leak Leading to Node-Level -
CVE-2026-53489
containerd: Arbitrary host CRI log file read via symlink fol -
CVE-2026-53492
containerd CRI checkpoint restore CDI annotation smuggling
Same vendor: containerd
-
CVE-2026-95837
containerd CRI plugin: Checkpoint restore bypasses destinati -
CVE-2026-107446
containerd ≤1.0.18 overlaybd整数溢出漏洞 -
CVE-2026-53493
Containerd has image-pull DoS via crafted OCI index graph am -
CVE-2026-53495
containerd CRI ExecSync Goroutine Leak Leading to Node-Level -
CVE-2026-53489
containerd: Arbitrary host CRI log file read via symlink fol
Same weakness: CWE-400
-
CVE-2026-105659
HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, -
CVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in Streamable -
CVE-2026-67414
RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion Do -
CVE-2026-101896
Angular: Denial of Service via Numeric URL Matrix Parameters -
CVE-2026-101895
Angular SSR: Denial of Service (DoS) via Infinite Loop on Ma
V. Comments for CVE-2026-95838
No comments yet