{"id":"CVE-2022-31030","aliases":["ALPINE-CVE-2022-31030","AZL-9918","BELL-CVE-2022-31030","DEBIAN-CVE-2022-31030","DSA-5162-1","EUVD-2022-5937","GHSA-5ffw-gxpp-mxpf","GO-2022-0482","MGASA-2022-0227","OESA-2022-1743","SUSE-SU-2022:2165-1","SUSE-SU-2022:2341-1","UBUNTU-CVE-2022-31030","USN-5521-1","USN-5776-1","openSUSE-SU-2024:12130-1"],"status":"published","title":"containerd CRI plugin: Host memory exhaustion through ExecSync","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00387,"percentile":0.33107,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-06-06T00:00:00Z","modified":"2026-11-03T08:03:52Z","fixes":[{"ecosystem":"Go","package":"github.com/containerd/containerd","fixed_in":["1.5.13","1.6.6"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["1.6.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"moby-containerd","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"containerd","fixed_in":["1.6.6~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"containerd","fixed_in":["1.6.6~ds1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"containerd","fixed_in":["1.6.6~ds1-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"docker-containerd","fixed_in":["1.5.13-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"containerd","fixed_in":["1.2.0-203.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"containerd","fixed_in":["1.2.0-203.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"containerd","fixed_in":["1.2.0-303.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","fixed_in":["1.2.6-0ubuntu1~16.04.6+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"containerd","fixed_in":["1.5.9-0ubuntu1~18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"containerd","fixed_in":["1.5.9-0ubuntu1~20.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"containerd","fixed_in":["1.5.9-0ubuntu3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"containerd","fixed_in":["1.6.6-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"moby-containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13~ds1-1~deb11u2"}]}],"versions":["1.4.12~ds1-1~deb11u1","1.4.13~ds1-1~deb11u1","1.4.5~ds1-2","1.4.5~ds1-2+deb11u1"],"bundled":2},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.5.13"},{"introduced":"1.6.0"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"docker-containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.13-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-203.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-203.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-303.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-16.62.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-98.83.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-16.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"docker-kubic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-150000.73.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"docker-kubic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.17_ce-150000.166.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-150000.30.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-0ubuntu1~16.04.6+esm2"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-0ubuntu1~18.04.2"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1","1.5.2-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.3","1.5.5-0ubuntu3~18.04.1","1.5.5-0ubuntu3~18.04.2","1.5.9-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-0ubuntu1~20.04.6"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2","1.3.3-0ubuntu2.3","1.4.4-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.1","1.5.2-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.3","1.5.5-0ubuntu3~20.04.1","1.5.5-0ubuntu3~20.04.2","1.5.9-0ubuntu1~20.04.1","1.5.9-0ubuntu1~20.04.4","1.5.9-0ubuntu1~20.04.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-0ubuntu3.1"}]}],"versions":["1.5.5-0ubuntu3","1.5.9-0ubuntu1","1.5.9-0ubuntu2","1.5.9-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-0ubuntu1~16.04.6+esm2"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-0ubuntu1~18.04.2"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1","1.5.2-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.3","1.5.5-0ubuntu3~18.04.1","1.5.5-0ubuntu3~18.04.2","1.5.9-0ubuntu1~18.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-0ubuntu1~20.04.6"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2","1.3.3-0ubuntu2.3","1.4.4-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.1","1.5.2-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.3","1.5.5-0ubuntu3~20.04.1","1.5.5-0ubuntu3~20.04.2","1.5.9-0ubuntu1~20.04.1","1.5.9-0ubuntu1~20.04.4","1.5.9-0ubuntu1~20.04.5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.9-0ubuntu3.1"}]}],"versions":["1.5.5-0ubuntu3","1.5.9-0ubuntu1","1.5.9-0ubuntu2","1.5.9-0ubuntu3"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1.1"}]}]}],"products":[{"vendor":"containerd","product":"containerd"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"linuxfoundation","product":"containerd"}],"references":[{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382","tags":["x_transferred","Product","Third Party Advisory","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/06/07/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web","report"]},{"url":"https://www.debian.org/security/2022/dsa-5162","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSIGDBHAB3I75JBJNGWEPBTJPS2FOVHD/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/REOZCUAPCA7NFDWYBDYX6EYXWLHABKBO/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202401-31","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31030","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REOZCUAPCA7NFDWYBDYX6EYXWLHABKBO/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSIGDBHAB3I75JBJNGWEPBTJPS2FOVHD/"},{"url":"https://github.com/advisories/GHSA-5ffw-gxpp-mxpf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-31030","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-31030","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31030.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-31030","tags":["advisory"]},{"url":"https://github.com/containerd/containerd","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/REOZCUAPCA7NFDWYBDYX6EYXWLHABKBO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSIGDBHAB3I75JBJNGWEPBTJPS2FOVHD","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REOZCUAPCA7NFDWYBDYX6EYXWLHABKBO","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSIGDBHAB3I75JBJNGWEPBTJPS2FOVHD","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2022-0227.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30525","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1743","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222165-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1192051","tags":["report"]},{"url":"https://bugzilla.suse.com/1199460","tags":["report"]},{"url":"https://bugzilla.suse.com/1199565","tags":["report"]},{"url":"https://bugzilla.suse.com/1200088","tags":["report"]},{"url":"https://bugzilla.suse.com/1200145","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31030","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222341-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-31030","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5776-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5521-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31030","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-32760","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41103","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24769","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24778","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-31030","title":"containerd CRI plugin: Host memory exhaustion through ExecSync","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-06T00:00:00Z","modified":"2024-08-03T07:03:40.336Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:34.940806Z"}],"euvd":[{"id":"EUVD-2022-5937","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-06T00:00:00Z","modified":"2024-08-03T07:03:40Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:25:34.735493Z"}],"ghsa":[{"id":"GHSA-5ffw-gxpp-mxpf","title":"containerd CRI plugin: Host memory exhaustion through ExecSync","description":"### Impact\n\nA bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API.  This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads.  Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility.\n\n### Patches\n\nThis bug has been fixed in containerd 1.6.6 and 1.5.13.  Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure that only trusted images and commands are used. \n\n### References\n\n* Similar fix in cri-o's CRI implementation https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j\n\n### Credits\n\nThe containerd project would like to thank David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md) during a security audit sponsored by CNCF and facilitated by OSTIF.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2022-06-06T22:07:10Z","modified":"2024-01-31T15:32:12Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2022-31030","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-09T14:15:08.55Z","modified":"2026-06-17T04:44:38.587Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:21.62951Z"}],"osv":[{"id":"ALPINE-CVE-2022-31030","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-09T14:15:08.55Z","modified":"2026-11-03T07:31:25.654335729Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"AZL-9918","title":"CVE-2022-31030 affecting package moby-containerd for versions less than 1.6.6-1","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-09T14:15:08Z","modified":"2026-04-21T04:35:11.033854Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2022-31030","title":"CVE-2022-31030 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:26.19752Z","modified":"2026-01-26T09:48:28.904224Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-31030","title":"containerd CRI plugin: Host memory exhaustion through ExecSync","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-06T00:00:00Z","modified":"2026-10-28T02:30:31.527339145Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DEBIAN-CVE-2022-31030","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-09T14:15:08.55Z","modified":"2026-11-03T08:03:52.422463241Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"GHSA-5ffw-gxpp-mxpf","title":"containerd CRI plugin: Host memory exhaustion through ExecSync","description":"### Impact\n\nA bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API.  This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads.  Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility.\n\n### Patches\n\nThis bug has been fixed in containerd 1.6.6 and 1.5.13.  Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure that only trusted images and commands are used. \n\n### References\n\n* Similar fix in cri-o's CRI implementation https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j\n\n### Credits\n\nThe containerd project would like to thank David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md) during a security audit sponsored by CNCF and facilitated by OSTIF.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2022-06-06T22:07:10Z","modified":"2026-09-10T03:49:49.235350096Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"OESA-2022-1743","title":"containerd security update","description":"containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability.  It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.\r\n\r\nSecurity Fix(es):\r\n\r\ncontainerd is an open source container runtime. A bug was found in the containerd\u0026apos;s CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd\u0026apos;s CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \u0026quot;exec\u0026quot; facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.(CVE-2022-31030)","status":"published","published":"2022-07-08T11:05:00Z","modified":"2026-08-18T01:16:43.715477535Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-31030","description":"containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an \"exec\" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.","status":"published","published":"2022-06-09T14:15:00Z","modified":"2026-02-04T02:25:39.942081Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"DSA-5162-1","title":"containerd - security update","status":"published","published":"2022-06-12T00:00:00Z","modified":"2026-03-09T02:11:12.185804Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"GO-2022-0482","title":"containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd","description":"containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd","status":"published","published":"2024-08-21T15:11:33Z","modified":"2026-02-04T04:07:30.567768Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"MGASA-2022-0227","title":"Updated docker-containerd packages fix security vulnerability","description":"A bug was found in the containerd's CRI implementation where programs\ninside a container can cause the containerd daemon to consume memory\nwithout bound during invocation of the 'ExecSync' API. (CVE-2022-31030)\n","status":"published","published":"2022-06-13T20:44:20Z","modified":"2026-04-16T04:41:53.051385689Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12130-1","title":"containerd-1.6.6-1.1 on GA media","description":"These are all security issues fixed in the containerd-1.6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:00.889115Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2165-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\ncontainerd:\n\n- CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API (bsc#1200145)\n\ndocker:\n\n- Update to Docker 20.10.17-ce. See upstream changelog online at\n  https://docs.docker.com/engine/release-notes/#201017 . bsc#1200145\n\nrunc:\n\nUpdate to runc v1.1.3.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3.\n\n* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on\n  s390 and s390x. This solves the issue where syscalls the host kernel did not\n  support would return `-EPERM` despite the existence of the `-ENOSYS` stub\n  code (this was due to how s390x does syscall multiplexing).\n* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as\n  intended; this fix does not affect runc binary itself but is important for\n  libcontainer users such as Kubernetes.\n* Inability to compile with recent clang due to an issue with duplicate\n  constants in libseccomp-golang.\n* When using systemd cgroup driver, skip adding device paths that don't exist,\n  to stop systemd from emitting warnings about those paths.\n* Socket activation was failing when more than 3 sockets were used.\n* Various CI fixes.\n* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.\n    \n- Fix issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by\n  that platform's syscall multiplexing semantics. (bsc#1192051 bsc#1199565)\n\nUpdate to runc v1.1.2.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2.\n\nSecurity issue fixed:\n\n- CVE-2022-29162: A bug was found in runc where runc exec --cap executed processes with\n  non-empty inheritable Linux process capabilities, creating an atypical Linux\n  environment. (bsc#1199460)\n\n- runc spec no longer sets any inheritable capabilities in the created\n  example OCI spec (config.json) file.\n\nUpdate to runc v1.1.1.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1.\n\n* runc run/start can now run a container with read-only /dev in OCI spec,\n  rather than error out. (#3355)\n* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)\n  libcontainer systemd v2 manager no longer errors out if one of the files\n  listed in /sys/kernel/cgroup/delegate do not exist in container's\n  cgroup. (#3387, #3404)\n* Loosen OCI spec validation to avoid bogus 'Intel RDT is not supported'\n  error. (#3406)\n* libcontainer/cgroups no longer panics in cgroup v1 managers if stat\n  of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)\n\nUpdate to runc v1.1.0.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0.\n\n- libcontainer will now refuse to build without the nsenter package being\n  correctly compiled (specifically this requires CGO to be enabled). This\n  should avoid folks accidentally creating broken runc binaries (and\n  incorrectly importing our internal libraries into their projects). (#3331)\n\nUpdate to runc v1.1.0~rc1.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.\n\n+ Add support for RDMA cgroup added in Linux 4.11.\n+ runc exec now produces exit code of 255 when the exec failed.\n  This may help in distinguishing between runc exec failures\n  (such as invalid options, non-running container or non-existent\n  binary etc.) and failures of the command being executed.\n+ runc run: new --keep option to skip removal exited containers artefacts.\n  This might be useful to check the state (e.g. of cgroup controllers) after\n  the container hasexited.\n+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD\n  (the latter is just an alias for SCMP_ACT_KILL).\n+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows\n  users to create sophisticated seccomp filters where syscalls can be\n  efficiently emulated by privileged processes on the host.\n+ checkpoint/restore: add an option (--lsm-mount-context) to set\n  a different LSM mount context on restore.\n+ intelrdt: support ClosID parameter.\n+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup\n  to use for the process being executed.\n+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1\n  machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc\n  run/exec now adds the container to the appropriate cgroup under it).\n+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s\n  behaviour.\n+ mounts: add support for bind-mounts which are inaccessible after switching\n  the user namespace. Note that this does not permit the container any\n  additional access to the host filesystem, it simply allows containers to\n  have bind-mounts configured for paths the user can access but have\n  restrictive access control settings for other users.\n+ Add support for recursive mount attributes using mount_setattr(2). These\n  have the same names as the proposed mount(8) options -- just prepend r\n  to the option name (such as rro).\n+ Add runc features subcommand to allow runc users to detect what features\n  runc has been built with. This includes critical information such as\n  supported mount flags, hook names, and so on. Note that the output of this\n  command is subject to change and will not be considered stable until runc\n  1.2 at the earliest. The runtime-spec specification for this feature is\n  being developed in opencontainers/runtime-spec#1130.\n* system: improve performance of /proc/$pid/stat parsing.\n* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change\n  the ownership of certain cgroup control files (as per\n  /sys/kernel/cgroup/delegate) to allow for proper deferral to the container\n  process.\n* runc checkpoint/restore: fixed for containers with an external bind mount\n  which destination is a symlink.\n* cgroup: improve openat2 handling for cgroup directory handle hardening.\n  runc delete -f now succeeds (rather than timing out) on a paused\n  container.\n* runc run/start/exec now refuses a frozen cgroup (paused container in case of\n  exec). Users can disable this using --ignore-paused.\n","status":"published","published":"2022-06-23T13:55:24Z","modified":"2026-02-04T03:30:08.039118Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2341-1","title":"Security update for containerd, docker and runc","description":"This update for containerd, docker and runc fixes the following issues:\n\ncontainerd:\n\n- CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API (bsc#1200145)\n\ndocker:\n\n- Update to Docker 20.10.17-ce. See upstream changelog online at\n  https://docs.docker.com/engine/release-notes/#201017. (bsc#1200145)\n\nrunc:\n\nUpdate to runc v1.1.3.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.3.\n\n* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on\n  s390 and s390x. This solves the issue where syscalls the host kernel did not\n  support would return `-EPERM` despite the existence of the `-ENOSYS` stub\n  code (this was due to how s390x does syscall multiplexing).\n* Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as\n  intended; this fix does not affect runc binary itself but is important for\n  libcontainer users such as Kubernetes.\n* Inability to compile with recent clang due to an issue with duplicate\n  constants in libseccomp-golang.\n* When using systemd cgroup driver, skip adding device paths that don't exist,\n  to stop systemd from emitting warnings about those paths.\n* Socket activation was failing when more than 3 sockets were used.\n* Various CI fixes.\n* Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.\n- Fixed issues with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by\n  that platform's syscall multiplexing semantics. (bsc#1192051 bsc#1199565)\n\nUpdate to runc v1.1.2.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.2.\n\nSecurity issue fixed:\n\n- CVE-2022-29162: A bug was found in runc where runc exec --cap executed processes with\n  non-empty inheritable Linux process capabilities, creating an atypical Linux\n  environment. (bsc#1199460)\n\n- `runc spec` no longer sets any inheritable capabilities in the created\n  example OCI spec (`config.json`) file.\n\nUpdate to runc v1.1.1.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.1.\n\n* runc run/start can now run a container with read-only /dev in OCI spec,\n  rather than error out. (#3355)\n* runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)\n  libcontainer systemd v2 manager no longer errors out if one of the files\n  listed in /sys/kernel/cgroup/delegate do not exist in container's\n  cgroup. (#3387, #3404)\n* Loosen OCI spec validation to avoid bogus 'Intel RDT is not supported'\n  error. (#3406)\n* libcontainer/cgroups no longer panics in cgroup v1 managers if stat\n  of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)\n\nUpdate to runc v1.1.0.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0.\n\n- libcontainer will now refuse to build without the nsenter package being\n  correctly compiled (specifically this requires CGO to be enabled). This\n  should avoid folks accidentally creating broken runc binaries (and\n  incorrectly importing our internal libraries into their projects). (#3331)\n\nUpdate to runc v1.1.0~rc1.\n\nUpstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.\n\n+ Add support for RDMA cgroup added in Linux 4.11.\n* runc exec now produces exit code of 255 when the exec failed.\n  This may help in distinguishing between runc exec failures\n  (such as invalid options, non-running container or non-existent\n  binary etc.) and failures of the command being executed.\n+ runc run: new --keep option to skip removal exited containers artefacts.\n  This might be useful to check the state (e.g. of cgroup controllers) after\n  the container hasexited.\n+ seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD\n  (the latter is just an alias for SCMP_ACT_KILL).\n+ seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows\n  users to create sophisticated seccomp filters where syscalls can be\n  efficiently emulated by privileged processes on the host.\n+ checkpoint/restore: add an option (--lsm-mount-context) to set\n  a different LSM mount context on restore.\n+ intelrdt: support ClosID parameter.\n+ runc exec --cgroup: an option to specify a (non-top) in-container cgroup\n  to use for the process being executed.\n+ cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1\n  machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc\n  run/exec now adds the container to the appropriate cgroup under it).\n+ sysctl: allow slashes in sysctl names, to better match sysctl(8)'s\n  behaviour.\n+ mounts: add support for bind-mounts which are inaccessible after switching\n  the user namespace. Note that this does not permit the container any\n  additional access to the host filesystem, it simply allows containers to\n  have bind-mounts configured for paths the user can access but have\n  restrictive access control settings for other users.\n+ Add support for recursive mount attributes using mount_setattr(2). These\n  have the same names as the proposed mount(8) options -- just prepend r\n  to the option name (such as rro).\n+ Add runc features subcommand to allow runc users to detect what features\n  runc has been built with. This includes critical information such as\n  supported mount flags, hook names, and so on. Note that the output of this\n  command is subject to change and will not be considered stable until runc\n  1.2 at the earliest. The runtime-spec specification for this feature is\n  being developed in opencontainers/runtime-spec#1130.\n* system: improve performance of /proc/$pid/stat parsing.\n* cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change\n  the ownership of certain cgroup control files (as per\n  /sys/kernel/cgroup/delegate) to allow for proper deferral to the container\n  process.\n* runc checkpoint/restore: fixed for containers with an external bind mount\n  which destination is a symlink.\n* cgroup: improve openat2 handling for cgroup directory handle hardening.\n  runc delete -f now succeeds (rather than timing out) on a paused\n  container.\n* runc run/start/exec now refuses a frozen cgroup (paused container in case of\n  exec). Users can disable this using --ignore-paused.\n- Update version data embedded in binary to correctly include the git commit of the release.\n","status":"published","published":"2022-07-08T14:09:57Z","modified":"2026-02-04T04:01:09.183959Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5521-1","title":"containerd vulnerabilities","description":"It was discovered that containerd insufficiently restricted permissions on\ncontainer root and plugin directories. If a user or automated system were\ntricked into launching a specially crafted container image, a remote\nattacker could traverse directory contents and modify files and execute\nprograms on the host file system, possibly leading to privilege escalation.\n(CVE-2021-41103)\n\nIt was discovered that containerd incorrectly handled file permission\nchanges. If a user or automated system were tricked into launching a\nspecially crafted container image, a remote attacker could change\npermissions on files on the host file system and possibly escalate\nprivileges. (CVE-2021-32760)\n\nIt was discovered that containerd allows attackers to gain access to read-\nonly copies of arbitrary files and directories on the host via a specially-\ncrafted image configuration. An attacker could possibly use this issue to\nobtain sensitive information. (CVE-2022-23648)\n\nIt was discovered that containerd incorrectly handled certain memory\noperations. A remote attacker could use this to cause a denial of service.\n(CVE-2022-31030)\n","status":"published","published":"2022-07-15T13:48:23Z","modified":"2026-06-25T13:31:18.205338116Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5776-1","title":"containerd vulnerabilities","description":"It was discovered that containerd incorrectly handled memory\nwhen receiving certain faulty Exec or ExecSync commands. A remote\nattacker could possibly use this issue to cause a denial of service\nor crash containerd. (CVE-2022-23471, CVE-2022-31030)\n\nIt was discovered that containerd incorrectly set up inheritable file\ncapabilities. An attacker could possibly use this issue to escalate \nprivileges inside a container. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-24769)\n\nIt was discovered that containerd incorrectly handled access to encrypted\ncontainer images when using imgcrypt library. A remote attacker could\npossibly use this issue to access encrypted images from other users. \nThis issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS. (CVE-2022-24778)\n","status":"published","published":"2022-12-13T08:35:00Z","modified":"2026-04-27T16:32:24.500883068Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}