OESA-2026-4566: containerd security update
containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc. Security Fix(es):
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.(CVE-2026-95838)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/containerdto a version that resolves this vulnerability.Fixed in 1.6.22-33.oe2403sp3 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 1.7.35 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.0.12 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.2.8 - Upgrade
Upgrade
containerdto a version that resolves this vulnerability.Fixed in 2.3.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running affected containerd versions that pull or import untrusted or malicious container images are exposed. The impact occurs during image layer unpacking, before a container needs to be started.
What does an attacker need to do to trigger the issue?
An attacker needs to provide a malicious image layer containing certain opaque whiteout configurations and have it pulled or imported by the affected containerd instance. No privileges are required by the vulnerability vector, but user interaction is required to pull or import the image.
What is the practical impact?
Processing the crafted image can cause repeated directory traversals, consuming CPU, delaying container startup, and reducing image-pull concurrency for unrelated deployments. The reported impact is availability degradation rather than confidentiality or integrity loss.
Which versions contain the fix?
The issue is fixed in containerd versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5. Versions prior to those releases in their respective release lines are affected.