Linuxfoundation Containerd vulnerabilities

• containerd containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull CVE-2026-53488 Fix available 9.4 CriticalJune 19, 2026
• containerd containerd: CRI checkpoint import allows local image tag poisoning CVE-2026-50195 Fix available 5.6 MediumJune 19, 2026
• containerd containerd image-triggered runtime DoS via unbounded group parsing CVE-2026-47262 Fix available 5.3 MediumJune 17, 2026
• containerd containerd CRI checkpoint restore CDI annotation smuggling CVE-2026-53492 Fix available 8.4 HighJune 17, 2026
• containerd containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore CVE-2026-53489 Fix available 8.2 HighJune 17, 2026
• containerd containerd user ID handling bypass allows runAsNonRoot evasion CVE-2026-46680 Public exploitFix available 7.3 HighMay 21, 2026
• containerd containerd CRI server: Host memory exhaustion through Attach goroutine leak CVE-2025-64329 Fix available 6.9 MediumNovember 6, 2025
• containerd containerd affected by a local privilege escalation via wide permissions on CRI directory CVE-2024-25621 Fix available 7.3 HighNovember 6, 2025
• containerd containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. CVE-2025-47291 Fix available 4.6 MediumMay 21, 2025
• containerd Containerd vulnerable to host filesystem access during image unpack CVE-2025-47290 Fix available 7.6 HighMay 20, 2025
• containerd, debian linux +1 more containerd has an integer overflow in User ID handling CVE-2024-40635 Public exploitFix available 4.6 MediumMarch 17, 2025
• containerd containerd supplementary groups are not set up properly CVE-2023-25173 Fix available 5.3 MediumFebruary 16, 2023
• containerd containerd OCI image importer memory exhaustion CVE-2023-25153 Fix available 6.2 MediumFebruary 16, 2023
• containerd containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak CVE-2022-23471 Fix available 5.7 MediumDecember 7, 2022
• containerd, debian linux, fedoraproject fedora +2 more containerd CRI plugin: Host memory exhaustion through ExecSync CVE-2022-31030 Fix available 5.5 MediumJune 6, 2022
• containerd, debian linux, fedoraproject fedora +2 more Insecure handling of image volumes in containerd CRI plugin CVE-2022-23648 Public exploitFix available EPSS 27.4% 7.5 HighMarch 2, 2022
• containerd, fedoraproject fedora +1 more Improper Preservation of Permissions in containerd CVE-2021-43816 Fix available 8.0 HighJanuary 5, 2022
• containerd, debian linux, fedoraproject fedora +2 more Insufficiently restricted permissions on plugin directories CVE-2021-41103 Fix available 5.9 MediumOctober 4, 2021
• containerd, fedoraproject fedora +1 more Archive package allows chmod of file outside of unpack target directory CVE-2021-32760 Fix available 5.0 MediumJuly 19, 2021
• containerd, fedoraproject fedora +1 more environment variable leak CVE-2021-21334 Fix available 6.3 MediumMarch 5, 2021
• containerd, debian linux, fedoraproject fedora +2 more containerd-shim API Exposed to Host Network Containers CVE-2020-15257 Public exploitFix available 5.2 MediumNovember 30, 2020
• containerd, canonical ubuntu linux, debian linux +2 more containerd can be coerced into leaking credentials during image pull CVE-2020-15157 Fix available 6.1 MediumOctober 15, 2020