github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface CRI implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during...

github.com/containerd/containerd: containerd: Denial of Service via maliciously crafted image leading to unbounded group parsing

A flaw was found in containerd, an open-source container runtime. A remote attacker could exploit this vulnerability by providing a maliciously crafted image. When a container is created from this image, it leads to uncontrolled resource consumption and memory exhaustion, causing the containerd...

github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface CRI plugin incorrectly restores container logs from a checkpoint image. This vulnerability, categorized as a Path Traversal CWE-61, allows an attacker to read arbitrary files on the host system by...

Important: containerd

Issue Overview: Memory exhaustion DoS causing OOM kill of containerd process NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq CVE-2026-47262 Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution NOTE:...

Fedora 45 : containerd (2026-dc2cbc1bc8)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dc2cbc1bc8 advisory. Automatic update for containerd-2.3.2-1.fc45. Changelog Fri Jun 26 2026 Bradley G Smith - 2.3.2-1 - Update to release v2.3.2 - Resolves: rhbz2464270...

Important: containerd

Issue Overview: Memory exhaustion DoS causing OOM kill of containerd process NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq CVE-2026-47262 Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution NOTE:...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: falco-no-driver, omnictl-multiarch, knative-kafka-broker-fips, helm, grafana-fips, snyk-cli, trivy-operator, prometheus-elasticsearch-exporter, external-secrets-operator, rancher, opentofu, vault, argocd-image-updater, argo-workflows-fips, coder, grafana,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: docker-cli-buildx-fips, falco-no-driver, knative-kafka-broker-fips, helm, omnictl-multiarch, grafana-fips, snyk-cli, prometheus-elasticsearch-exporter, external-secrets-operator, rancher, opentofu, vault, argo-workflows-fips, grafana, frankenphp-8.2, vitess,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: docker-cli-buildx-fips, falco-no-driver, knative-kafka-broker-fips, helm, melange, grafana-fips, omnictl-multiarch, snyk-cli, trivy-operator, pulumi-kubernetes-operator, splunk-otel-collector, prometheus-elasticsearch-exporter, external-secrets-operator, rancher,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: docker-cli-buildx-fips, falco-no-driver, knative-kafka-broker-fips, helm, melange, grafana-fips, omnictl-multiarch, snyk-cli, trivy-operator, pulumi-kubernetes-operator, prometheus-elasticsearch-exporter, external-secrets-operator, rancher, opentofu, step-issuer-fips...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: podman, tkn, docker, pulumi-language-java, nerdctl, kargo, k9s, kubescape, nuclei, melange, age, gatus, cosign, crossplane-provider-azure-storage, trivy, rancher, pulumi-language-yaml, rancher-agent, pulumi, flux-notification-controller, mods, mattermost,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kyverno, flux, spire-server, nerdctl, k9s, kubescape, k3s, gitlab-kas, falco-no-driver, external-secrets-operator, skaffold, trivy-operator, telegraf, argocd-image-updater, zot, kine, snyk-cli, aactl, istio, prometheus, loki, flux-source-controller, containerd, kots,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kyverno, flux, spire-server, nerdctl, k9s, kubescape, k3s, gitlab-kas, falco-no-driver, external-secrets-operator, skaffold, trivy-operator, telegraf, argocd-image-updater, zot, kine, snyk-cli, aactl, istio, prometheus, loki, flux-source-controller, containerd, kots,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: podman, pulumi-language-java, nerdctl, k9s, kubescape, nuclei, melange, trivy, rancher, pulumi-language-yaml, rancher-agent, pulumi, mattermost, cloud-provider-aws, wolfictl, minio, fscrypt, nfpm, act, k3s, caddy, skaffold, external-secrets-operator, openbao, telegra...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: dagger, podman, kyverno, flux, nfpm, spire-server, pulumi-language-java, nerdctl, k9s, act, kubescape, k3s, gitlab-kas, falco-no-driver, external-secrets-operator, nuclei, skaffold, guac, trivy-operator, telegraf, argocd-image-updater, opentofu, gptscript, zot,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: podman, kyverno, flux, spire-server, nerdctl, k3s, gitlab-kas, falco-no-driver, external-secrets-operator, docker-cli-buildx, telegraf, zot, kine, snyk-cli, buildah, aactl, istio, prometheus, loki, containerd, kots, rancher, kaf, rancher-agent, kubernetes-dashboard,...

OPENSUSE-SU-2026:21072-1 Security update for trivy

This update for trivy fixes the following issues Update to version 0.71.2: - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption bsc1267268. - CVE-2026-46680:...

Security update for containerd

This update for containerd fixes the following issues CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header bsc1260296. CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZ...

ROS-20260626-73-0016

The vulnerability in containerd is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

SUSE SLED15 / SLES15 Security Update : containerd (SUSE-SU-2026:2639-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2639-1 advisory. This update for containerd fixes the following issues - CVE-2026-33186: google.golang.org/grpc: authorization...