USN-8471-1: containerd vulnerabilities

Q: Which Ubuntu releases are affected by each issue?

The HTTP/2 SETTINGS-frame denial of service issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, and 22.04 LTS. The label-propagation issue that could allow host code execution affects Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS. No release-specific scope is provided for the image group-parsing memory-exhaustion issue.

Q: What outcomes could exploitation cause?

The HTTP/2 parsing flaw can make containerd enter an infinite loop, causing denial of service. The image group-parsing flaw can consume excessive memory, also causing denial of service, while the label-propagation flaw could allow arbitrary code execution on the host.

Q: What attacker interaction is described for these issues?

For the HTTP/2 issue, the advisory explicitly describes a remote attacker. For the image parsing and label propagation issues, it states only that an attacker could exploit the flaws; the required access level, image source, and configuration conditions are not specified.

Published Jun 25, 2026

Updated

It was discovered that containerd incorrectly handled HTTP/2 SETTINGS frames. A remote attacker could possibly use this issue to cause containerd to enter an infinite loop, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2026-33814) Jakub Ciolek and Kyle Elliott discovered that containerd incorrectly handled group parsing when creating containers from images. An attacker could possibly use this issue to cause containerd to consume excessive memory, resulting in a denial of service. (CVE-2026-47262) Robert Prast discovered that containerd incorrectly propagated labels from image configurations to containers. An attacker could possibly use this issue to execute arbitrary code on the host. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53488)

Affected Software

18 affected componentsFixes available

All of the following

ubuntu/golang-github-containerd-containerd-api-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/golang-github-containerd-containerd-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=26.04

All of the following

ubuntu/golang-github-containerd-containerd-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=24.04

All of the following

ubuntu/golang-github-containerd-containerd-dev<1.6.12-0ubuntu1~22.04.11

1.6.12-0ubuntu1~22.04.11

Ubuntu Ubuntu=22.04

All of the following

ubuntu/golang-github-containerd-containerd-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=20.04

All of the following

ubuntu/containerd<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/golang-github-containerd-containerd-dev<Ubuntu Pro

Ubuntu Pro

Ubuntu Ubuntu=18.04

All of the following

ubuntu/containerd<1.2.6-0ubuntu1~16.04.6+esm7

1.2.6-0ubuntu1~16.04.6+esm7

Ubuntu Ubuntu=16.04

All of the following

ubuntu/golang-github-docker-containerd-dev<1.2.6-0ubuntu1~16.04.6+esm7

1.2.6-0ubuntu1~16.04.6+esm7

Ubuntu Ubuntu=16.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/golang-github-containerd-containerd-api-dev to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/golang-github-containerd-containerd-dev to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/golang-github-containerd-containerd-dev to a version that resolves this vulnerability.
Fixed in 1.6.12-0ubuntu1~22.04.11
Upgrade
Upgrade ubuntu/containerd to a version that resolves this vulnerability.
Fixed in Ubuntu Pro
Upgrade
Upgrade ubuntu/containerd to a version that resolves this vulnerability.
Fixed in 1.2.6-0ubuntu1~16.04.6+esm7
Upgrade
Upgrade ubuntu/golang-github-docker-containerd-dev to a version that resolves this vulnerability.
Fixed in 1.2.6-0ubuntu1~16.04.6+esm7

Event History

Jun 25, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which Ubuntu releases are affected by each issue?

The HTTP/2 SETTINGS-frame denial of service issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, and 22.04 LTS. The label-propagation issue that could allow host code execution affects Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS. No release-specific scope is provided for the image group-parsing memory-exhaustion issue.

What outcomes could exploitation cause?

The HTTP/2 parsing flaw can make containerd enter an infinite loop, causing denial of service. The image group-parsing flaw can consume excessive memory, also causing denial of service, while the label-propagation flaw could allow arbitrary code execution on the host.

What attacker interaction is described for these issues?

For the HTTP/2 issue, the advisory explicitly describes a remote attacker. For the image parsing and label propagation issues, it states only that an attacker could exploit the flaws; the required access level, image source, and configuration conditions are not specified.

USN-8471-1: containerd vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Ubuntu releases are affected by each issue?

What outcomes could exploitation cause?

What attacker interaction is described for these issues?

Company

Resources

Contact

Frequently Asked Questions

Which Ubuntu releases are affected by each issue?

What outcomes could exploitation cause?

What attacker interaction is described for these issues?