CVE-2026-64773

A vulnerability exists in container versions prior to 1.2.0 where an attacker reaching a published TCP port can trigger the host's forwarding process to buffer an unbounded amount of data in memory. The issue persists as long as the backend container connection takes to complete, as there is no c...

CVE-2026-20613

The ArchiveReader.extractContents() function in the containerization project (used by cctl image load and container image load) fails to perform pathname validation during archive extraction. This flaw allows a maliciously constructed archive to use relative pathnames to extract files into any us...

CVE-2026-64777

The container tool (version prior to 1.2.0 ) is vulnerable to an improper limitation of a pathname to a restricted directory. A malicious builder peer can request an in-context file by name from the host and potentially receive the contents of any file the name resolves to, even if the resolution...

CVE-2026-28909

The container tool, an open-source tool by Apple for running Linux containers on Mac devices, is vulnerable to credential exposure in versions prior to 0.12.3 . The root cause is a flaw where hostnames matching specific bypass patterns allow users to connect to malicious registries, resulting in ...