abstractshimmer

ABSTRACT SHIMMER CVE-2020-15257 This repo contains proof-of-concept exploit code for CVE-2020-15257 as described in our blog post. While written for containerd 1.2.x and 1.3.x, it should work on pre-patch versions of containerd 1.4.x. $ go build $ docker build -t abstractshimmer . $ docker run --...

pumba

Chaos testing tool for Docker, containerd, and Podman Quick Start · User Guide · Network Chaos · Deployment · Contributing Pumba is a chaos testing and network emulation tool for Docker, containerd, and Podman containers. Inspired by Netflix Chaos Monkey, Pumba brings chaos engineering to the...

CVE-2022-23648-POC

PoC for CVE-2022-23648 This is a proof of concept for @fel1x's CVE-2022-23648. Disclosure info here, CVE info here and a blog with some more information and mitigation ideas here. The Containerfile has the info. needed, and you can change the target of the VOLUME to try out different paths. Easie...

CVE-2024-21626

CVE-2024-21626 Exploit Working Directory docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Important is to put -w /proc/self/fd/8\ Access the host filesystem using cat ../../../../../../../../../etc/passwd inside the container Exploit Symlink 1. docker run --name...

cve-2019-5736-reproducer

CVE-2019-5736 reproducer This allows you to confirm RunC-CVE-2019-5736 works on your KVM instance. Workflow overview Build the docker.io related packages vulerable to CVE-2019-5736 in this repo Launch an Ubuntu 18.04 KVM instance on LXD Install the vulnerable .deb packages in the VM Try the...

Amazon Linux 2 : containerd (ALASDOCKER-2026-153)

The version of containerd installed on the remote host is prior to 2.3.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-153 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a craft...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2026-125)

The version of containerd installed on the remote host is prior to 2.3.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-125 advisory. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1,...

Important: containerd

Issue Overview: containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runti...

Important: containerd

Issue Overview: containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runti...

Important: containerd

Issue Overview: containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runti...

Important: containerd

Issue Overview: containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage before container start, causing long ContainerCreating stalls and, at larger sizes, node/runti...

GO-2026-6686 vulnerabilities

Vulnerabilities for packages: chaos-mesh, docker, gosu, umoci, k3d, eks-distro-fips, cloudbeat, crossplane-function-kcl-fips, cloudbeat-fips, ctop-fips, dagger, eks-distro, envoy-gateway-fips, containerd, gosu-fips, kubevirt-cdi-importer-fips, runc-fips, rancher-agent, google-osconfig-agent,...

GO-2026-6686 vulnerabilities

Vulnerabilities for packages: dagger, containerd, datadog-agent, ctop, vcluster, undock, k3d, gosu, k3s, docker, zarf, xeol, runc, scorecard, neuvector-scanner, act, newrelic-infrastructure-agent...

Linux Distros Unpatched Vulnerability : CVE-2026-77395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - golang-github-containerd-stargz-snapshotter - None Ubuntu Linux - Unknown description CVE-2026-77395 Note that Nessus relies on the presence of t...

Linux Distros Unpatched Vulnerability : CVE-2026-71482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - golang-github-containerd-stargz-snapshotter - None Ubuntu Linux - Unknown description CVE-2026-71482 Note that Nessus relies on the presence of t...

CVE-2026-53493

A flaw was found in containerd. During an image pull operation, containerd fails to enforce recursion and deduplication limits when traversing descriptor graphs in Open Container Initiative OCI image indexes. A remote attacker can exploit this flaw by serving a crafted image index, triggering...

CVE-2026-95838

A flaw was found in containerd. When unpacking image layers with specific file configurations such as opaque whiteout markers, the unpack handler performs repeated directory traversals. An attacker can exploit this by providing a maliciously crafted container image, leading to a Denial of Service...

PT-2026-118085

containerd: Unpack DoS via repeated opaque whiteouts in github.com/containerd/containerd...

CVE-2026-95837

A flaw was found in containerd. This flaw allows privilege escalation when creating a container from a saved checkpoint because process security settings are restored directly from checkpoint data rather than enforcing the destination security policy. An attacker with permissions to create...

OESA-2026-4236 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...