CVE-2026-95838: containerd: Unpack DoS via repeated opaque whiteouts

Q: Which environments are exposed to this issue?

Environments running containerd versions earlier than 1.7.35, 2.0.12, 2.2.8, or 2.3.5 are affected when they pull or import a malicious image containing the relevant opaque whiteout layer configuration.

Q: What does an attacker need to do to trigger the denial of service?

An attacker needs to provide a malicious container image layer configured with repeated opaque whiteouts and have that image pulled or imported. No privileges are required according to the supplied CVSS vector, but user interaction is required to initiate the pull or import.

Q: What is the operational impact during exploitation?

Processing the malicious image can consume CPU through repeated directory traversals, delay container startup, and reduce image-pull concurrency for unrelated deployments.

Q: What versions contain the fix?

Upgrade containerd to 1.7.35, 2.0.12, 2.2.8, or 2.3.5, as applicable to the release line in use.

Published Oct 12, 2026

Updated

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

Affected Software

1 affected component

containerd containerd<1.7.35, <2.0.12, <2.2.8, <2.3.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade containerd to a version that resolves this vulnerability.
Fixed in 1.7.35
Upgrade
Upgrade containerd to a version that resolves this vulnerability.
Fixed in 2.0.12
Upgrade
Upgrade containerd to a version that resolves this vulnerability.
Fixed in 2.2.8
Upgrade
Upgrade containerd to a version that resolves this vulnerability.
Fixed in 2.3.5

Event History

Oct 12, 2026

CVE Published

via MITRE·07:53 PM

Data Sourced

via MITRE·07:53 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which environments are exposed to this issue?

Environments running containerd versions earlier than 1.7.35, 2.0.12, 2.2.8, or 2.3.5 are affected when they pull or import a malicious image containing the relevant opaque whiteout layer configuration.

What does an attacker need to do to trigger the denial of service?

An attacker needs to provide a malicious container image layer configured with repeated opaque whiteouts and have that image pulled or imported. No privileges are required according to the supplied CVSS vector, but user interaction is required to initiate the pull or import.

What is the operational impact during exploitation?

Processing the malicious image can consume CPU through repeated directory traversals, delay container startup, and reduce image-pull concurrency for unrelated deployments.

What versions contain the fix?

Upgrade containerd to 1.7.35, 2.0.12, 2.2.8, or 2.3.5, as applicable to the release line in use.

CVE-2026-95838: containerd: Unpack DoS via repeated opaque whiteouts

Affected Software

Remediation

Event History

Frequently Asked Questions

Which environments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the operational impact during exploitation?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the operational impact during exploitation?

What versions contain the fix?