Medium severity · published Oct 12, 2026
CVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
containerd · containerd
< 1.7.35; >= 2.0.0-beta.0, < 2.0.12; >= 2.2.0, < 2.2.8; >= 2.3.0, < 2.3.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95838
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95838
x_refsource_CONFIRM
https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4
x_refsource_MISC
https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0
More from containerd
9.9
CVE-2026-50195
containerd: CRI checkpoint import allows local image tag poisoning
9.6
CVE-2026-53492
containerd CRI checkpoint restore CDI annotation smuggling
8.8
CVE-2026-53488
containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
7.8
CVE-2026-95837
containerd CRI plugin: Checkpoint restore bypasses destination security context
7.8
CVE-2026-46680
containerd user ID handling bypass allows runAsNonRoot evasion