https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-09T16:39:55.985970+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-47262 CVE-2026-47262 — containerd image-triggered runtime DoS via unbounded group parsing 2026-10-09T16:39:55.990244+00:00

Affected: containerd

containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.

 https://vulnerability.circl.lu/vuln/usn-8471-1 USN-8471-1 — containerd vulnerabilities 2026-10-09T16:39:55.990436+00:00

Affected: Ubuntu:Pro:16.04:LTS: containerd, Ubuntu:Pro:18.04:LTS: containerd, Ubuntu:Pro:20.04:LTS: containerd, Ubuntu:22.04:LTS: containerd, Ubuntu:Pro:24.04:LTS: containerd, Ubuntu:Pro:26.04:LTS: containerd

It was discovered that containerd incorrectly handled HTTP/2 SETTINGS frames. A remote attacker could possibly use this issue to cause containerd to enter an infinite loop, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2026-33814)

Jakub Ciolek and Kyle Elliott discovered that containerd incorrectly handled group parsing when creating containers from images. An attacker could possibly use this issue to cause containerd to consume excessive memory, resulting in a denial of service. (CVE-2026-47262)

Robert Prast discovered that containerd incorrectly propagated labels from image configurations to containers. An attacker could possibly use this issue to execute arbitrary code on the host. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53488)