CVE-2026-64773: Container container vulnerability
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
containerto a version that resolves this vulnerability.Fixed in 1.2.0
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Hosts running affected container versions are exposed when they publish a container TCP port that an attacker can reach. The attacker does not need direct access to the host if they can connect to that published port.
What does an attacker need to do to exploit it?
The attacker needs network reachability to a published TCP port and can send data while the backend container connection is still completing. The forwarding process may then retain the client data in host memory without a size or time limit.
What is the practical impact?
An attacker may cause unbounded memory consumption in the host forwarding process by extending the time before the backend container connection completes. This can create a denial-of-service condition on the host.
What version addresses the vulnerability?
The issue is addressed in container version 1.2.0.