Medium severity · published Jul 1, 2026
CVE-2026-47262
containerd image-triggered runtime DoS via unbounded group parsing
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
containerd · containerd
>= 1.7.0, < 1.7.33; >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47262
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47262
Vendor Advisory
https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq
More from containerd
9.9
CVE-2026-50195
containerd: CRI checkpoint import allows local image tag poisoning
9.6
CVE-2026-53492
containerd CRI checkpoint restore CDI annotation smuggling
8.8
CVE-2026-53488
containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
7.8
CVE-2026-95837
containerd CRI plugin: Checkpoint restore bypasses destination security context
7.8
CVE-2026-46680
containerd user ID handling bypass allows runAsNonRoot evasion