Important: docker

Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...

Amazon Linux 2 : docker (ALASECS-2026-157)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-157 advisory. eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crash...

Amazon Linux 2 : docker (ALASDOCKER-2026-162)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-162 advisory. eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink...

Important: docker

Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2026-133)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-133 advisory. eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic...

Amazon Linux 2023 : docker (ALAS2023-2026-3391)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3391 advisory. eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz...

Important: docker

Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...

Important: docker

Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...

CVE-2026-71482

stargz-snapshotter estargz v0.10.0 through v0.18.2: getSource in estargz.go follows hardlinks recursively without tracking visited entries, so an eStargz layer with cyclic hardlinks causes unbounded recursion and a stack overflow denial of service. Fixed in v0.19.0...