github.com/containerd/containerd (Go)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.7.36 or later clears every advisory below that has a fix.

Upgrade commands

go get github.com/containerd/containerd@v1.7.36 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-rp3h-jf77-q9p4 containerd: Unpack DoS via repeated opaque whiteouts	Medium EPSS 0.22%	`< 1.7.35`	`1.7.35`
GHSA-rp3h-jf77-q9p4 containerd: Unpack DoS via repeated opaque whiteouts	Medium EPSS 0.22%	`< 1.7.35`	`1.7.35`
GO-2026-6791 containerd CRI plugin: Checkpoint restore bypasses destination security context	High EPSS 0.11%	`all versions`	No fix yet
GHSA-pg57-6jwg-q645 Containerd has image-pull DoS via crafted OCI index graph amplification	Medium EPSS 0.36%	`< 1.7.36`	`1.7.36`
GHSA-pg57-6jwg-q645 Containerd has image-pull DoS via crafted OCI index graph amplification	Medium EPSS 0.36%	`< 1.7.36`	`1.7.36`
GHSA-7jxh-36q5-gcqv containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service	Medium EPSS 0.16%	`< 1.7.35`	`1.7.35`
GHSA-7jxh-36q5-gcqv containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service	Medium EPSS 0.16%	`< 1.7.35`	`1.7.35`
GO-2026-5064 containerd CRI checkpoint restore CDI annotation smuggling	Critical EPSS 0.35%	`all versions`	No fix yet
GO-2026-5622 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore	Medium EPSS 0.17%	`all versions`	No fix yet
GHSA-xhf5-7wjv-pqxp containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull	High EPSS 0.18%	`>= 1.7.0, < 1.7.33`	`1.7.33`
GHSA-xhf5-7wjv-pqxp containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull	High EPSS 0.18%	`>= 1.7.0, < 1.7.33`	`1.7.33`
GO-2026-5338 containerd: CRI checkpoint import allows local image tag poisoning	Critical EPSS 0.30%	`all versions`	No fix yet
GHSA-jpcc-p29g-p8mq containerd image-triggered runtime DoS via unbounded group parsing	Medium EPSS 0.27%	`>= 1.7.0, < 1.7.33`	`1.7.33`
GHSA-jpcc-p29g-p8mq containerd image-triggered runtime DoS via unbounded group parsing	Medium EPSS 0.27%	`>= 1.7.0, < 1.7.33`	`1.7.33`
GHSA-fqw6-gf59-qr4w containerd user ID handling bypass allows runAsNonRoot evasion	High EPSS 0.16%	`>= 1.7.27, < 1.7.32`	`1.7.32`
GHSA-fqw6-gf59-qr4w containerd user ID handling bypass allows runAsNonRoot evasion	High EPSS 0.16%	`>= 1.7.27, < 1.7.32`	`1.7.32`
GHSA-m6hq-p25p-ffr2 containerd CRI server: Host memory exhaustion through Attach goroutine leak	Medium EPSS 0.17%	`< 1.7.29`	`1.7.29`
GHSA-m6hq-p25p-ffr2 containerd CRI server: Host memory exhaustion through Attach goroutine leak	Medium EPSS 0.17%	`< 1.7.29`	`1.7.29`
GHSA-pwhc-rpq9-4c8w containerd affected by a local privilege escalation via wide permissions on CRI directory	High EPSS 0.17%	`< 1.7.29`	`1.7.29`
GHSA-pwhc-rpq9-4c8w containerd affected by a local privilege escalation via wide permissions on CRI directory	High EPSS 0.17%	`< 1.7.29`	`1.7.29`
GHSA-265r-hfxg-fhmg containerd has an integer overflow in User ID handling	High EPSS 0.30%	`< 1.6.38`	`1.6.38`
GHSA-265r-hfxg-fhmg containerd has an integer overflow in User ID handling	High EPSS 0.30%	`>= 1.7.0-beta.0, < 1.7.27`	`1.7.27`
GHSA-265r-hfxg-fhmg containerd has an integer overflow in User ID handling	High EPSS 0.30%	`< 1.6.38` `>= 1.7.0-beta.0, < 1.7.27`	`1.6.38` `1.7.27`
GHSA-c9cp-9c75-9v8c containerd started with non-empty inheritable Linux process capabilities	Low	`< 1.5.11`	`1.5.11`
GHSA-c9cp-9c75-9v8c containerd started with non-empty inheritable Linux process capabilities	Low	`< 1.5.11` `>= 1.6.0, < 1.6.2`	`1.5.11` `1.6.2`
GHSA-c9cp-9c75-9v8c containerd started with non-empty inheritable Linux process capabilities	Low	`>= 1.6.0, < 1.6.2`	`1.6.2`
GHSA-6g2q-w5j3-fwh4 containerd environment variable leak	Medium EPSS 1.95%	`>= 1.4.0, < 1.4.4`	`1.4.4`
GHSA-6g2q-w5j3-fwh4 containerd environment variable leak	Medium EPSS 1.95%	`< 1.3.10`	`1.3.10`
GHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a container	Medium	`< 1.6.26` `>= 1.7.0, < 1.7.11`	`1.6.26` `1.7.11`
GHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a container	Medium	`< 1.6.26`	`1.6.26`
GHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a container	Medium	`>= 1.7.0, < 1.7.11`	`1.7.11`
GHSA-259w-8hf6-59c2 OCI image importer memory exhaustion in github.com/containerd/containerd	Medium EPSS 0.36%	`< 1.5.18`	`1.5.18`
GHSA-259w-8hf6-59c2 OCI image importer memory exhaustion in github.com/containerd/containerd	Medium EPSS 0.36%	`>= 1.6.0, < 1.6.18`	`1.6.18`
GHSA-259w-8hf6-59c2 OCI image importer memory exhaustion in github.com/containerd/containerd	Medium EPSS 0.36%	`< 1.5.18` `>= 1.6.0, < 1.6.18`	`1.5.18` `1.6.18`
GHSA-hmfx-3pcx-653p Supplementary groups are not set up properly in github.com/containerd/containerd	High EPSS 1.04%	`< 1.5.18`	`1.5.18`
GHSA-hmfx-3pcx-653p Supplementary groups are not set up properly in github.com/containerd/containerd	High EPSS 1.04%	`>= 1.6.0, < 1.6.18`	`1.6.18`
GHSA-hmfx-3pcx-653p Supplementary groups are not set up properly in github.com/containerd/containerd	High EPSS 1.04%	`< 1.5.18` `>= 1.6.0, < 1.6.18`	`1.5.18` `1.6.18`
GHSA-2qjp-425j-52j9 containerd CRI stream server vulnerable to host memory exhaustion via terminal	Medium EPSS 1.11%	`< 1.5.16`	`1.5.16`
GHSA-2qjp-425j-52j9 containerd CRI stream server vulnerable to host memory exhaustion via terminal	Medium EPSS 1.11%	`>= 1.6.0, < 1.6.12`	`1.6.12`
GHSA-2qjp-425j-52j9 containerd CRI stream server vulnerable to host memory exhaustion via terminal	Medium EPSS 1.11%	`< 1.5.16` `>= 1.6.0, < 1.6.12`	`1.5.16` `1.6.12`
GHSA-5ffw-gxpp-mxpf containerd CRI plugin: Host memory exhaustion through ExecSync	Medium EPSS 0.39%	`>= 1.6.0, < 1.6.6`	`1.6.6`
GHSA-5ffw-gxpp-mxpf containerd CRI plugin: Host memory exhaustion through ExecSync	Medium EPSS 0.39%	`< 1.5.13`	`1.5.13`
GHSA-5ffw-gxpp-mxpf containerd CRI plugin: Host memory exhaustion through ExecSync	Medium EPSS 0.39%	`< 1.5.13` `>= 1.6.0, < 1.6.6`	`1.5.13` `1.6.6`
GHSA-crp2-qrr5-8pq7 containerd CRI plugin: Insecure handling of image volumes	High EPSS 27.39%	`< 1.4.13`	`1.4.13`
GHSA-crp2-qrr5-8pq7 containerd CRI plugin: Insecure handling of image volumes	High EPSS 27.39%	`>= 1.5.0, < 1.5.10`	`1.5.10`
GHSA-crp2-qrr5-8pq7 containerd CRI plugin: Insecure handling of image volumes	High EPSS 27.39%	`< 1.4.13` `>= 1.5.0, < 1.5.10` `>= 1.6.0, < 1.6.1`	`1.4.13` `1.5.10` `1.6.1`
GHSA-crp2-qrr5-8pq7 containerd CRI plugin: Insecure handling of image volumes	High EPSS 27.39%	`>= 1.6.0, < 1.6.1`	`1.6.1`
GHSA-742w-89gc-8m9c containerd v1.2.x can be coerced into leaking credentials during image pull	Medium EPSS 2.30%	`< 1.2.14`	`1.2.14`
GHSA-742w-89gc-8m9c containerd v1.2.x can be coerced into leaking credentials during image pull	Medium EPSS 2.30%	`< 1.2.14`	`1.2.14`
GHSA-mvff-h3cj-wj9c Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux	High EPSS 1.81%	`>= 1.5.0, < 1.5.9`	`1.5.9`
GHSA-mvff-h3cj-wj9c Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux	High EPSS 1.81%	`>= 1.5.0, < 1.5.9`	`1.5.9`
GHSA-5j5w-g665-5m35 Ambiguous OCI manifest parsing	Low	`< 1.4.12`	`1.4.12`
GHSA-5j5w-g665-5m35 Ambiguous OCI manifest parsing	Low	`>= 1.5.0, < 1.5.8`	`1.5.8`
GHSA-5j5w-g665-5m35 Ambiguous OCI manifest parsing	Low	`< 1.4.12` `>= 1.5.0, < 1.5.8`	`1.4.12` `1.5.8`
GHSA-c2h3-6mxw-7mvq Insufficiently restricted permissions on plugin directories	Medium EPSS 0.52%	`< 1.4.11` `>= 1.5.0, < 1.5.7`	`1.4.11` `1.5.7`
GHSA-c2h3-6mxw-7mvq Insufficiently restricted permissions on plugin directories	Medium EPSS 0.52%	`>= 1.5.0, < 1.5.7`	`1.5.7`
GHSA-c2h3-6mxw-7mvq Insufficiently restricted permissions on plugin directories	Medium EPSS 0.52%	`< 1.4.11`	`1.4.11`
GHSA-c72p-9xmj-rx3w Archive package allows chmod of file outside of unpack target directory	Medium EPSS 1.59%	`< 1.4.8`	`1.4.8`
GHSA-c72p-9xmj-rx3w Archive package allows chmod of file outside of unpack target directory	Medium EPSS 1.59%	`>= 1.5.0, < 1.5.4`	`1.5.4`
GHSA-c72p-9xmj-rx3w Archive package allows chmod of file outside of unpack target directory	Medium EPSS 1.59%	`< 1.4.8` `>= 1.5.0, < 1.5.4`	`1.4.8` `1.5.4`
GHSA-36xw-fx78-c5r4 containerd-shim API Exposed to Host Network Containers	Medium EPSS 3.12%	`< 1.3.9` `>= 1.4.0, < 1.4.3`	`1.3.9` `1.4.3`
GHSA-36xw-fx78-c5r4 containerd-shim API Exposed to Host Network Containers	Medium EPSS 3.12%	`>= 1.4.0, < 1.4.3`	`1.4.3`
GHSA-36xw-fx78-c5r4 containerd-shim API Exposed to Host Network Containers	Medium EPSS 3.12%	`< 1.3.9`	`1.3.9`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor