Live › vulnerability › CVE-2026-95838
Go to dashboardcontainerd's layer unpack handler repeatedly traverses directories when processing certain opaque whiteout configurations in an image layer. A malicious image can make pulling or importing it consume CPU, slow container startup and reduce image-pull concurrency.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/containerd/containerd | go | < 1.7.35 | 1.7.35 |
| github.com/containerd/containerd/v2 | go | >= 2.3.0, < 2.3.5 | 2.0.12, 2.2.8, 2.3.5 |
1.7.35 for the 1.x line, or in the 2.3.0 to 2.3.4 range or below 2.2.8 or 2.0.12 on other linesUpgrade containerd to 1.7.35, 2.0.12, 2.2.8, or 2.3.5 depending on your release line. unknown for any other mitigation.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-95838")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.