CVE-2026-47262: containerd image-triggered runtime DoS via unbounded group parsing

Analyzed

AliasesRHSA-2026:26990UBUNTU-CVE-2026-47262DEBIAN-CVE-2026-47262+608 more

Published 01-07-2026Last modified 01-07-2026

Vulnerability summary

CVE-2026-47262 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in containerd. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.27%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 11

OPENSUSE-SU-2026:11102-1 OPENSUSE-SU-2026:11107-1 OPENSUSE-SU-2026:21072-1 OPENSUSE-SU-2026:21213-1 OPENSUSE-SU-2026:21483-1 RHSA-2026:25535+10 more

Timeline

01-07-2026
PublishedVulnerability first disclosed.
01-07-2026
Last modifiedVulnerability information updated.

Description

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.

CVSS metrics

11 scores · 9 sources · 2 versions

v4.05.3v3.15.5

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.27% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

amazon-ecs-agent< 1.104.0-r2
amazon-ecs-agent-fips< 1.104.0-r2
auditbeat-7All versions (No fix recorded)
auditbeat-fips-7All versions (No fix recorded)
buildctl< 0.31.0-r2

buildctl-fips< 0.31.0-r1
buildkitd< 0.31.0-r2
buildkitd-fips< 0.31.0-r1
cg< 0.2.295-r2
chainctl< 0.2.289-r1
chainctl-fips< 0.2.289-r1
chaos-mesh< 2.8.3-r1
chaos-mesh-daemon< 2.8.3-r1
chaos-mesh-dashboard< 2.8.3-r1
chaos-mesh-fips< 2.8.3-r1
chaos-mesh-fips-daemon< 2.8.3-r1
chaos-mesh-fips-dashboard< 2.8.3-r1
chartmuseum< 0.16.5-r13
chartmuseum-fips< 0.16.5-r11
cloudbeat-8.17< 8.17.10-r26
cloudbeat-8.19< 8.19.16-r2 | < 8.19.16-r3
cloudbeat-9.0< 9.0.8-r29 | < 9.0.8-r28
cloudbeat-9.1< 9.1.10-r21 | < 9.1.10-r20
cloudbeat-9.2< 9.2.8-r9 | < 9.2.8-r8
cloudbeat-9.3< 9.3.5-r3 | < 9.3.5-r2
cloudbeat-9.4< 9.4.2-r2 | < 9.4.2-r3
cloudbeat-fips-8.17< 8.17.10-r31
cloudbeat-fips-8.19< 8.19.16-r2 | < 8.19.16-r1
cloudbeat-fips-9.0< 9.0.8-r32 | < 9.0.8-r31
cloudbeat-fips-9.1< 9.1.10-r25 | < 9.1.10-r24
cloudbeat-fips-9.2< 9.2.8-r8 | < 9.2.8-r7
cloudbeat-fips-9.3< 9.3.5-r3 | < 9.3.5-r2
cloudbeat-fips-9.4< 9.4.2-r5 | < 9.4.2-r4
cluster-api-helm-controller< 0.6.4-r7
cluster-api-helm-controller-fips< 0.6.4-r7
consul-k8s-1.1-cli< 1.1.18-r40
consul-k8s-1.3-cli< 1.3.9-r45
consul-k8s-1.4-cli< 1.4.10-r31
consul-k8s-1.5-cli< 1.5.9-r29
consul-k8s-1.6-cli< 1.6.10-r24
consul-k8s-1.7-cli< 1.7.13-r14
consul-k8s-1.9-cli< 1.9.8-r5
consul-k8s-2.0-cli< 2.0.0-r2
consul-k8s-fips-1.1-cli< 1.1.18-r39
consul-k8s-fips-1.3-cli< 1.3.9-r41
consul-k8s-fips-1.4-cli< 1.4.10-r31
consul-k8s-fips-1.5-cli< 1.5.9-r32
consul-k8s-fips-1.6-cli< 1.6.10-r25
consul-k8s-fips-1.7-cli< 1.7.13-r16
consul-k8s-fips-1.9-cli< 1.9.8-r4
consul-k8s-fips-2.0-cli< 2.0.0-r3
crossplane-2.3-crank< 2.3.3-r0
crossplane-fips-2.3-crank< 2.3.3-r0
ctop< 0.7.7-r37
dagger< 0.20.8-r9
datadog-agent-7.71< 7.71.2-r29
datadog-agent-7.72< 7.72.4-r31
datadog-agent-7.73< 7.73.3-r23
datadog-agent-7.74< 7.74.1-r21
datadog-agent-7.75All versions (No fix recorded)
datadog-agent-7.76< 7.76.3-r28 | < 7.76.3-r41
datadog-agent-7.77< 7.77.3-r17
datadog-agent-7.78< 7.78.4-r12
datadog-agent-7.79< 7.79.2-r5
datadog-agent-7.80< 7.80.4-r1
datadog-agent-fips-7.71< 7.71.2-r21
datadog-agent-fips-7.72< 7.72.4-r28
datadog-agent-fips-7.73< 7.73.3-r23
datadog-agent-fips-7.74< 7.74.1-r21
datadog-agent-fips-7.75All versions (No fix recorded)
datadog-agent-fips-7.76< 7.76.3-r26
datadog-agent-fips-7.77< 7.77.3-r18
datadog-agent-fips-7.78< 7.78.4-r9
datadog-agent-fips-7.79< 7.79.2-r4
datadog-agent-fips-7.80< 7.80.4-r2
docker-cli-buildx< 0.35.0-r1
docker-cli-buildx-fips< 0.35.0-r1
docker-compose< 5.1.4-r6
docker-compose-fips< 5.1.4-r5
dockerd-28All versions (No fix recorded)
dockerd-29< 29.6.0-r1
dockerd-fips-28All versions (No fix recorded)
dockerd-fips-29< 29.5.2-r4
dogstatsd-7.71< 7.71.2-r29
dogstatsd-7.72< 7.72.4-r31
dogstatsd-7.73< 7.73.3-r23
dogstatsd-7.74< 7.74.1-r21
dogstatsd-7.75All versions (No fix recorded)
dogstatsd-7.76< 7.76.3-r28
dogstatsd-7.77< 7.77.3-r17
dogstatsd-7.78< 7.78.4-r12
dogstatsd-7.79< 7.79.2-r5
dogstatsd-7.80< 7.80.4-r1
eksctl< 0.227.0-r5
envoy-gateway-1.5-egctl< 1.5.9-r2
envoy-gateway-1.6-egctl< 1.6.7-r2
envoy-gateway-1.7-egctl< 1.7.4-r2
envoy-gateway-1.8-egctl< 1.8.2-r2
envoy-gateway-egctl< 1.8.1-r2
envoy-gateway-fips-1.5-egctl< 1.5.9-r2
envoy-gateway-fips-1.6-egctl< 1.6.7-r2
envoy-gateway-fips-1.7-egctl< 1.7.4-r2
envoy-gateway-fips-1.8-egctl< 1.8.2-r2
envoy-gateway-fips-egctl< 1.8.1-r1
falco-no-driver< 0.45.0-r0
filebeat-7All versions (No fix recorded)
filebeat-fips-7All versions (No fix recorded)
filebeat-oss-7All versions (No fix recorded)
filebeat-oss-fips-7All versions (No fix recorded)
fuse-overlayfs-snapshotter< 2.1.7-r17
gatekeeper-3.20-gatorAll versions (No fix recorded)
gatekeeper-3.21-gator< 3.21.1-r13
gitlab-rails-ce-18.1All versions (No fix recorded)
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11< 18.11.6-r7
gitlab-rails-ce-18.5All versions (No fix recorded)
gitlab-rails-ce-18.6All versions (No fix recorded)
gitlab-rails-ce-18.7All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0< 19.0.4-r6
gitlab-rails-ce-19.1< 19.1.2-r3
gitlab-rails-ce-fips-18.1All versions (No fix recorded)
gitlab-rails-ce-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-fips-18.11< 18.11.6-r6
gitlab-rails-ce-fips-18.5All versions (No fix recorded)
gitlab-rails-ce-fips-18.6All versions (No fix recorded)
gitlab-rails-ce-fips-18.7All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0< 19.0.4-r4
gitlab-rails-ce-fips-19.1< 19.1.2-r2
google-osconfig-agent< 20251028.00-r23
grype< 0.114.0-r1
grype-db< 0.54.0-r1
grype-fips< 0.114.0-r1
harvester< 1.8.1-r0
harvester-fips< 1.8.1-r0
harvester-fips-webhook< 1.8.1-r0
harvester-webhook< 1.8.1-r0
headlamp< 0.43.0-r1
headlamp-fips< 0.43.0-r2
heartbeat-7All versions (No fix recorded)
heartbeat-fips-7All versions (No fix recorded)
helm-3< 3.21.2-r1 | < 3.22.0-r0
helm-exporter< 1.3.0-r11
helm-exporter-fips< 1.3.0-r12
helm-fips-3< 3.21.2-r1
helm-mapkubeapis< 0.6.1-r21
helm-operator< 1.42.2-r13
helm-operator-fips< 1.42.2-r6
helm-push< 0.11.1-r16
helm-set-status< 0.3.0-r20
helmfile< 1.5.5-r1
jfrog-cli< 2.109.0-r1
k3s-1.31All versions (No fix recorded)
k3s-fips-1.33All versions (No fix recorded)
k3s-static< 1.36.2.1-r1
k3s-static-1.31All versions (No fix recorded)
k3s-static-1.34< 1.34.9.1-r1
k3s-static-1.35< 1.35.6.1-r1
k8sgpt< 0.4.34-r1 | < 0.4.38-r3 | All versions (No fix recorded)
k8ssandra-client< 0.9.1-r2
k9s< 0.51.0-r1 | < 0.51.0-r2
k9s-fips< 0.51.0-r2 | < 0.51.0-r1
kaniko< 1.25.15-r10 | < 1.25.15-r9
kaniko-fips< 1.25.15-r8 | < 1.25.15-r7
kaniko-warmer< 1.25.15-r9 | < 1.25.15-r10
kaniko-warmer-fips< 1.25.15-r8 | < 1.25.15-r7
kargo< 1.10.7-r1
kgateway-2.3< 2.3.4-r1
kgateway-2.4< 2.4.2-r1
kgateway-fips-2.3< 2.3.4-r1
kgateway-fips-2.4< 2.4.2-r2
kots< 1.130.4-r8
kube-arangodb-1.3All versions (No fix recorded)
kube-arangodb-1.4< 1.4.3-r11
kube-arangodb-fips-1.3All versions (No fix recorded)
kube-arangodb-fips-1.4< 1.4.3-r6
kube-mgmt< 11.0.7-r4
kube-mgmt-fips< 11.0.7-r6
kubescape< 4.0.9-r1
kubescape-operator< 0.2.151-r1 | < 0.2.172-r2
kubescape-operator-fips< 0.2.151-r1
kubescape-server< 4.0.9-r2
kubescape-server-downloader< 4.0.9-r2
kubescape-server-fips< 4.0.9-r2
kubescape-server-fips-downloader< 4.0.9-r2
kubevela-vela-cli< 1.10.8-r11
kubevela-vela-cli-fips< 1.10.8-r12
kubevela-vela-core< 1.10.8-r11
kubevela-vela-core-fips< 1.10.8-r12
linkerd2-cli< 26.6.3-r2
linkerd2-controller< 26.6.3-r2
linkerd2-controller-compatAll versions (No fix recorded)
linkerd2-debug< 26.9.2-r0
linkerd2-fips-cli< 26.6.3-r1
linkerd2-fips-controller< 26.6.3-r1
linkerd2-fips-metrics-api< 26.6.3-r1

Show all 199

Alpine1 product

containerd≥ 1.7.0, < 2.3.2-r0

2 vendors · 200 products · Showing 200 of 371

References

17 links

github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mqX Refsource CONFIRMARTICLEREPORTAdvisoryWEBVendor Advisory
access.redhat.com/errata/RHSA-2026:26990Advisory
images.redhat.comARTICLE
access.redhat.com/security/cve/CVE-2026-47262REPORT
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26990.jsonAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2496126REPORT
www.cve.org/CVERecord?id=CVE-2026-47262AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-47262AdvisoryOval
ubuntu.com/security/CVE-2026-47262REPORT

Show all 17 references

ubuntu.com/security/notices/USN-8471-1Advisory
ubuntu.com/security/notices/USN-8472-1Advisory
ubuntu.com/security/notices/USN-8473-1Advisory
security-tracker.debian.org/tracker/CVE-2026-47262Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47262.jsonAdvisory
github.com/containerd/containerdPACKAGE
security.alpinelinux.org/vuln/CVE-2026-47262Advisory