CVE-2026-47262

EUVD-2026-41106

01.07.2026, 19:16

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 18.58%

Affected Products (NVD)

Vendor	Product	Version
linuxfoundation	containerd	1.7.0 ≤ 𝑥 < 1.7.33
linuxfoundation	containerd	2.0.0 ≤ 𝑥 < 2.0.10
linuxfoundation	containerd	2.1.0 ≤ 𝑥 < 2.1.9
linuxfoundation	containerd	2.2.0 ≤ 𝑥 < 2.2.5
linuxfoundation	containerd	2.3.0 ≤ 𝑥 < 2.3.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

containerd

bookworm	vulnerable
bookworm (security)	vulnerable
forky	2.1.9+ds1-5 fixed
sid	2.1.9+ds1-5 fixed
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

containerd

bionic	Fixed in 1.6.12-0ubuntu1~18.04.1+esm4 released
focal	Fixed in 1.6.12-0ubuntu1~20.04.8+esm2 released
jammy	Fixed in 1.6.12-0ubuntu1~22.04.11 released
noble	Fixed in 1.6.24~ds1-1ubuntu1.3+esm3 released
questing	ignored
resolute	Fixed in 1.7.24~ds1-10ubuntu1+esm1 released
stonking	needed
xenial	Fixed in 1.2.6-0ubuntu1~16.04.6+esm7 released

containerd-app

focal	Fixed in 1.7.24-0ubuntu1~20.04.2+esm2 released
jammy	Fixed in 2.2.1-0ubuntu1~22.04.2 released
noble	Fixed in 2.2.1-0ubuntu1~24.04.3 released
questing	Fixed in 2.2.1-0ubuntu1~25.10.2 released
resolute	Fixed in 2.2.2-0ubuntu1.1 released
stonking	not-affected

containerd-stable

jammy	dne
noble	dne
questing	Fixed in 2.1.6-0ubuntu1~25.10.2 released
resolute	Fixed in 2.2.2-0ubuntu1.1 released
stonking	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

containerd

suse enterprise server 15 SP4

1.7.29-150000.152.1

fixed

containerd-ctr

suse enterprise sap 15 SP7	1.7.29-150000.152.1 fixed
suse enterprise server 15 SP4	1.7.29-150000.152.1 fixed
suse enterprise server 15 SP7	1.7.29-150000.152.1 fixed

containerd-devel

suse enterprise sap 15 SP7	1.7.29-150000.152.1 fixed
suse enterprise server 15 SP4	1.7.29-150000.152.1 fixed
suse enterprise server 15 SP7	1.7.29-150000.152.1 fixed

Amazon Linux Releases

Amazon Package

Release

containerd

Amazon Linux 2023

0:2.2.4-1.amzn2023.0.3

fixed

containerd-debuginfo

Amazon Linux 2023

0:2.2.4-1.amzn2023.0.3

fixed

containerd-debugsource

Amazon Linux 2023

0:2.2.4-1.amzn2023.0.3

fixed

containerd-stress

Amazon Linux 2023

0:2.2.4-1.amzn2023.0.3

fixed

containerd-stress-debuginfo

Amazon Linux 2023

0:2.2.4-1.amzn2023.0.3

fixed

docker

Amazon Linux 2023

0:25.0.18-1.amzn2023.0.1

fixed

docker-debuginfo

Amazon Linux 2023

0:25.0.18-1.amzn2023.0.1

fixed

docker-debugsource

Amazon Linux 2023

0:25.0.18-1.amzn2023.0.1

fixed

nerdctl

Amazon Linux 2	0:2.3.5-1.amzn2.0.1 fixed
Amazon Linux 2023	0:2.3.5-1.amzn2023.0.1 fixed

nerdctl-debuginfo

Amazon Linux 2

0:2.3.5-1.amzn2.0.1

fixed

runfinch-finch

Amazon Linux 2023

0:1.19.0-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

containerd2

Azure Linux 3.0

0:2.2.4-3.azl3

fixed

moby-containerd-cc

Azure Linux 3.0

0:1.7.7-19.azl3

fixed

Common Weakness Enumeration

CWE-400 - Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References

https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq