{"schemaVersion":3,"id":"CVE-2026-95838","aliases":["DEBIAN-CVE-2026-95838","GHSA-rp3h-jf77-q9p4","CGA-2f2q-2h2m-2hm2","CGA-2w2c-9hmc-pf2f","CGA-3gh5-rjff-6whg","CGA-3gp2-pw88-wmr7","CGA-3hpf-pvrv-f7fr","CGA-3vch-85cc-6p77","CGA-4pqr-pv55-qg95","CGA-4ww2-mw3j-jjmc","CGA-5hcj-gv6g-r3qv","CGA-5mxx-mc5w-g3w5","CGA-62m7-964c-gccj","CGA-6jc3-xwj5-p42v","CGA-6r9m-wx2r-683v","CGA-6rh7-v364-j943","CGA-6wfw-q6qm-53j3","CGA-7ghf-7x35-gvfc","CGA-7q87-x6j9-hxpm","CGA-7w92-3j2v-wp2w","CGA-8p9p-9hwq-qhhj","CGA-9gxm-45r9-722c","CGA-c3qm-ph3x-fj3g","CGA-cmh6-fp82-f3m8","CGA-cvhv-3gp3-7h7q","CGA-f3mw-6g57-mjj5","CGA-fwj2-v48j-cjgp","CGA-gpf7-p43g-77p4","CGA-h42c-5wr7-cp56","CGA-h5j2-gwpm-v887","CGA-h922-5hv9-8qhw","CGA-hjrv-9c2g-9frp","CGA-j88q-35m8-26gp","CGA-jp6r-43vc-3j7p","CGA-m42w-29r8-x6h5","CGA-p648-5m45-xhrj","CGA-pgfj-3x6q-7mfp","CGA-pjqv-qp4m-6fvp","CGA-q9pf-r99j-5wcv","CGA-qv75-6rfg-44r9","CGA-r2v3-r7j9-2vh6","CGA-r42p-8qhg-w2c5","CGA-r962-3ph4-fwp5","CGA-rj9g-j3x5-vf98","CGA-rvj4-ch23-x248","CGA-v74w-9fpq-v53f","CGA-w9mh-rgpw-q8rx","CGA-xx9v-m48h-vg7v","UBUNTU-CVE-2026-95838","CGA-qvjj-h27f-w58w","CGA-vfp8-xgqg-r272","GO-2026-6796"],"status":"published","duplicateOf":null,"title":null,"description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","dates":{"published":"2026-10-12T19:53:24.599Z","modified":"2026-10-13T20:24:33.956Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.6,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"NVD","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":4.6,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":4.6,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":4.6,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":4.6,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":4.6,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":4.6,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":0.00215,"percentile":0.11135,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-13T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00215,"percentile":0.11135}],"last30":[{"date":"2026-10-13T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00215,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00215,"percentile":0.11135}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"},{"id":"CWE-407","name":"Inefficient Algorithmic Complexity","description":"An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Low","url":"https://cwe.mitre.org/data/definitions/407.html"}],"affected":[{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-agent-7.82","name":"datadog-agent-7.82","label":"datadog-agent-7.82","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-agent-7.82","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dogstatsd-7.82","name":"dogstatsd-7.82","label":"dogstatsd-7.82","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dogstatsd-7.82","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.11","name":"gitlab-rails-ce-18.11","label":"gitlab-rails-ce-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.11","name":"gitlab-rails-ce-fips-18.11","label":"gitlab-rails-ce-fips-18.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-1.31","name":"k3s-1.31","label":"k3s-1.31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-1.31","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"k3s-static-1.31","name":"k3s-static-1.31","label":"k3s-static-1.31","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/k3s-static-1.31","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rancher-2.10","name":"rancher-2.10","label":"rancher-2.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rancher-2.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rancher-2.11","name":"rancher-2.11","label":"rancher-2.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rancher-2.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rancher-agent-2.10","name":"rancher-agent-2.10","label":"rancher-agent-2.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rancher-agent-2.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"rancher-agent-2.11","name":"rancher-agent-2.11","label":"rancher-agent-2.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/rancher-agent-2.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"upwind-agent","name":"upwind-agent","label":"upwind-agent","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/upwind-agent","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"containerd","product":"containerd","name":"containerd","label":"containerd","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.7.35","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.0.0-beta.0, < 2.0.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.2.0, < 2.2.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.3.0, < 2.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.35 | ≥ 2.0.0-beta.0, < 2.0.12 | ≥ 2.2.0, < 2.2.8 | ≥ 2.3.0, < 2.3.5","eol":null,"hubHref":"/vendor/containerd/containerd"},{"vendor":"debian","product":"containerd","name":"containerd","label":"containerd","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/containerd","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"containerd","name":"containerd","label":"containerd","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/containerd","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"containerd-app","name":"containerd-app","label":"containerd-app","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/containerd-app","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"containerd-stable","name":"containerd-stable","label":"containerd-stable","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/containerd-stable","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/containerd","product":"containerd","name":"github.com/containerd/containerd","label":"containerd","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/containerd/containerd","purlType":"golang","versions":[{"text":"< 1.7.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.35","eol":null,"hubHref":null},{"vendor":"github.com/containerd/containerd","product":"v2","name":"github.com/containerd/containerd/v2","label":"v2","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/containerd/containerd/v2","purlType":"golang","versions":[{"text":"< 2.0.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.2.0, < 2.2.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.3.0, < 2.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.12 | ≥ 2.2.0, < 2.2.8 | ≥ 2.3.0, < 2.3.5","eol":null,"hubHref":null}],"affectedCount":29,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0","label":"github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0","hostname":"github.com","tags":["X Refsource MISC","WEB","FIX","REPORT"]},{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4","label":"github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Advisory","REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-95838","label":"security-tracker.debian.org/tracker/CVE-2026-95838","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95838","label":"nvd.nist.gov/vuln/detail/CVE-2026-95838","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/containerd/containerd","label":"github.com/containerd/containerd","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95838.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95838.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-95838","label":"ubuntu.com/security/CVE-2026-95838","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95838","label":"www.cve.org/CVERecord?id=CVE-2026-95838","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:12152-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:12152-1"]},"timeline":[{"kind":"published","date":"2026-10-12T19:53:24.599Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-13T20:24:33.956Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":18,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:41:01.427Z","stale":false,"partial":false}}