CLEANSTART-2026-LI04504 Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps

Security vulnerability affects the containerd package. Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps...

CLEANSTART-2026-TF52309 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the containerd package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-YQ07083 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the containerd package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-ZK08124 spdystream is a Go library for multiplexing streams over SPDY connections

Security vulnerability affects the containerd package. spdystream is a Go library for multiplexing streams over SPDY connections...

CLEANSTART-2026-OJ68067 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

Security vulnerability affects the containerd package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards...

CLEANSTART-2026-GU03381 CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container

Security vulnerability affects the containerd package. The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container...

CLEANSTART-2026-RA97554 runc is a CLI tool for spawning and running containers according to the OCI specification

Security vulnerability affects the containerd package. runc is a CLI tool for spawning and running containers according to the OCI specification...

CLEANSTART-2026-GW80468 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Security vulnerability affects the containerd package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

CLEANSTART-2026-BL51043 compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, ...

Security vulnerability affects the containerd package. The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption ...

CLEANSTART-2026-PG05502 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass

Security vulnerability affects the containerd package. SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

CLEANSTART-2026-QB75766 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the containerd package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

CLEANSTART-2026-WQ27487 tar

Security vulnerability affects the containerd package. tar...

CLEANSTART-2026-PA36556 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

Security vulnerability affects the containerd package. If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources...

CLEANSTART-2026-LC87549 Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

Security vulnerability affects the containerd package. Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service...

CLEANSTART-2026-DR35313 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Security vulnerability affects the containerd package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions...

CLEANSTART-2026-JP90307 Arithmetic over induction variables in loops were not correctly checked for underflow or overflow

Security vulnerability affects the containerd package. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow...

CLEANSTART-2026-EK17359 For certain crafted inputs, a 'ed25519

Security vulnerability affects the containerd package. For certain crafted inputs, a 'ed25519...

CLEANSTART-2026-MF73184 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

Security vulnerability affects the containerd package. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs...

CLEANSTART-2026-TD03320 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the containerd package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CLEANSTART-2026-JN22771 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

Security vulnerability affects the containerd package. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation...