CVE-2026-95838: containerd Uncontrolled Resource Consumption
CVSS: 4.6v4.0MediumAwaiting analysis
AliasesDEBIAN-CVE-2026-95838GHSA-rp3h-jf77-q9p4CGA-2f2q-2h2m-2hm2CGA-2w2c-9hmc-pf2fCGA-3gh5-rjff-6whgCGA-3gp2-pw88-wmr7CGA-3hpf-pvrv-f7frCGA-3vch-85cc-6p77CGA-4pqr-pv55-qg95CGA-4ww2-mw3j-jjmcCGA-5hcj-gv6g-r3qvCGA-5mxx-mc5w-g3w5CGA-62m7-964c-gccjCGA-6jc3-xwj5-p42vCGA-6r9m-wx2r-683vCGA-6rh7-v364-j943CGA-6wfw-q6qm-53j3CGA-7ghf-7x35-gvfcCGA-7q87-x6j9-hxpmCGA-7w92-3j2v-wp2wCGA-8p9p-9hwq-qhhjCGA-9gxm-45r9-722cCGA-c3qm-ph3x-fj3gCGA-cmh6-fp82-f3m8CGA-cvhv-3gp3-7h7qCGA-f3mw-6g57-mjj5CGA-fwj2-v48j-cjgpCGA-gpf7-p43g-77p4CGA-h42c-5wr7-cp56CGA-h5j2-gwpm-v887CGA-h922-5hv9-8qhwCGA-hjrv-9c2g-9frpCGA-j88q-35m8-26gpCGA-jp6r-43vc-3j7pCGA-m42w-29r8-x6h5CGA-p648-5m45-xhrjCGA-pgfj-3x6q-7mfpCGA-pjqv-qp4m-6fvpCGA-q9pf-r99j-5wcvCGA-qv75-6rfg-44r9CGA-r2v3-r7j9-2vh6CGA-r42p-8qhg-w2c5CGA-r962-3ph4-fwp5CGA-rj9g-j3x5-vf98CGA-rvj4-ch23-x248CGA-v74w-9fpq-v53fCGA-w9mh-rgpw-q8rxCGA-xx9v-m48h-vg7vUBUNTU-CVE-2026-95838CGA-qvjj-h27f-w58wCGA-vfp8-xgqg-r272
Published 12-10-2026Last modified 13-10-2026
Vulnerability summary
CVE-2026-95838 is a medium (CVSS 4.6) Uncontrolled Resource Consumption vulnerability in containerd. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.1% of scored vulnerabilities.
CVSS score
4.6/10
010
Medium · v4.0 (NVD)EPSS score
0.21%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 12-10-2026PublishedVulnerability first disclosed.
- 13-10-2026Last modifiedVulnerability information updated.
Description
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 4.6Preferred score · NVD (NIST)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSourcesAll 6 agree
- CVE.orgCNA4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · GoEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- OSV · UbuntuEcosystem advisory · calculated4.6MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
13-10-202619-10-2026
EPSS score0.21%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Affected systems
Chainguard22 products
- commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
- datadog-agent-7.82All versions (No fix recorded)
- dogstatsd-7.82All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Ubuntu3 products
- containerdAll versions (No fix recorded)
- containerd-appAll versions (No fix recorded)
- containerd-stableAll versions (No fix recorded)
Containerd1 product
- containerd< 1.7.35 | ≥ 2.0.0-beta.0, < 2.0.12 | ≥ 2.2.0, < 2.2.8 | ≥ 2.3.0, < 2.3.5
Debian1 product
- containerdAll versions (No fix recorded)
Github.com/containerd1 product
- containerd< 1.7.35
Github.com/containerd/containerd1 product
- v2< 2.0.12 | ≥ 2.2.0, < 2.2.8 | ≥ 2.3.0, < 2.3.5
6 vendors · 29 products
References
8 links- github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0X Refsource MISCWEBFIXREPORT
- github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4X Refsource CONFIRMWEBAdvisoryREPORT
