CVE-2026-53488
Fixed in a distro release EPSS <1%CVSS 9.4
containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | 1.7.33 |
| Go | github.com/containerd/containerd/v2 | 2.0.10 |
| Go | github.com/containerd/containerd/v2 | 2.1.9 |
| Go | github.com/containerd/containerd/v2 | 2.2.5 |
| Go | github.com/containerd/containerd/v2 | 2.3.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | amazon-ecs-agent | 1.104.0-r2 |
| Chainguard | amazon-ecs-agent-fips | 1.104.0-r2 |
| Chainguard | auditbeat-7 | no fix |
| Chainguard | auditbeat-fips-7 | no fix |
| Chainguard | buildctl | 0.31.0-r2 |
| Chainguard | buildctl-fips | 0.31.0-r1 |
| Chainguard | buildkitd | 0.31.0-r2 |
| Chainguard | buildkitd-fips | 0.31.0-r1 |
| Chainguard | cg | 0.2.295-r2 |
| Chainguard | chainctl | 0.2.289-r1 |
| Chainguard | chainctl-fips | 0.2.289-r1 |
| Chainguard | chaos-mesh | 2.8.3-r1 |
| Chainguard | chaos-mesh-daemon | 2.8.3-r1 |
| Chainguard | chaos-mesh-dashboard | 2.8.3-r1 |
| Chainguard | chaos-mesh-fips | 2.8.3-r1 |
| Chainguard | chaos-mesh-fips-daemon | 2.8.3-r1 |
| Chainguard | chaos-mesh-fips-dashboard | 2.8.3-r1 |
| Chainguard | chartmuseum | 0.16.5-r13 |
| Chainguard | chartmuseum-fips | 0.16.5-r11 |
| Chainguard | cloudbeat-8.17 | 8.17.10-r26 |
| Chainguard | cloudbeat-8.19 | 8.19.16-r2 |
| Chainguard | cloudbeat-8.19 | 8.19.16-r3 |
| Chainguard | cloudbeat-9.0 | 9.0.8-r28 |
| Chainguard | cloudbeat-9.0 | 9.0.8-r29 |
| Chainguard | cloudbeat-9.1 | 9.1.10-r21 |
| Chainguard | cloudbeat-9.1 | 9.1.10-r20 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r9 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r8 |
| Chainguard | cloudbeat-9.3 | 9.3.5-r2 |
| Chainguard | cloudbeat-9.3 | 9.3.5-r3 |
| Chainguard | cloudbeat-9.4 | 9.4.2-r2 |
| Chainguard | cloudbeat-9.4 | 9.4.2-r3 |
| Chainguard | cloudbeat-fips-8.17 | 8.17.10-r31 |
| Chainguard | cloudbeat-fips-8.19 | 8.19.16-r1 |
| Chainguard | cloudbeat-fips-8.19 | 8.19.16-r2 |
| Chainguard | cloudbeat-fips-9.0 | 9.0.8-r31 |
| Chainguard | cloudbeat-fips-9.0 | 9.0.8-r32 |
| Chainguard | cloudbeat-fips-9.1 | 9.1.10-r24 |
| Chainguard | cloudbeat-fips-9.1 | 9.1.10-r25 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r8 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r7 |
| Chainguard | cloudbeat-fips-9.3 | 9.3.5-r3 |
| Chainguard | cloudbeat-fips-9.3 | 9.3.5-r2 |
| Chainguard | cloudbeat-fips-9.4 | 9.4.2-r4 |
| Chainguard | cloudbeat-fips-9.4 | 9.4.2-r5 |
| Chainguard | cluster-api-helm-controller | 0.6.4-r7 |
| Chainguard | cluster-api-helm-controller-fips | 0.6.4-r7 |
| Chainguard | consul-k8s-1.1-cli | 1.1.18-r40 |
| Chainguard | consul-k8s-1.3-cli | 1.3.9-r45 |
| Chainguard | consul-k8s-1.4-cli | 1.4.10-r31 |
| Chainguard | consul-k8s-1.5-cli | 1.5.9-r29 |
| Chainguard | consul-k8s-1.6-cli | 1.6.10-r24 |
| Chainguard | consul-k8s-1.7-cli | 1.7.13-r14 |
| Chainguard | consul-k8s-1.9-cli | 1.9.8-r5 |
| Chainguard | consul-k8s-2.0-cli | 2.0.0-r2 |
| Chainguard | consul-k8s-fips-1.1-cli | 1.1.18-r39 |
| Chainguard | consul-k8s-fips-1.3-cli | 1.3.9-r41 |
| Chainguard | consul-k8s-fips-1.4-cli | 1.4.10-r31 |
| Chainguard | consul-k8s-fips-1.5-cli | 1.5.9-r32 |
| Chainguard | consul-k8s-fips-1.6-cli | 1.6.10-r25 |
| Chainguard | consul-k8s-fips-1.7-cli | 1.7.13-r16 |
| Chainguard | consul-k8s-fips-1.9-cli | 1.9.8-r4 |
| Chainguard | consul-k8s-fips-2.0-cli | 2.0.0-r3 |
| Chainguard | crossplane-2.3-crank | 2.3.3-r0 |
| Chainguard | crossplane-fips-2.3-crank | 2.3.3-r0 |
| Chainguard | ctop | 0.7.7-r37 |
| Chainguard | dagger | 0.20.8-r9 |
| Chainguard | datadog-agent-7.71 | 7.71.2-r29 |
| Chainguard | datadog-agent-7.72 | 7.72.4-r31 |
| Chainguard | datadog-agent-7.73 | 7.73.3-r23 |
| Chainguard | datadog-agent-7.74 | 7.74.1-r21 |
| Chainguard | datadog-agent-7.75 | no fix |
| Chainguard | datadog-agent-7.76 | 7.76.3-r28 |
| Chainguard | datadog-agent-7.76 | 7.76.3-r41 |
| Chainguard | datadog-agent-7.76 | no fix |
| Chainguard | datadog-agent-7.77 | 7.77.3-r17 |
| Chainguard | datadog-agent-7.78 | 7.78.4-r12 |
| Chainguard | datadog-agent-7.79 | 7.79.2-r5 |
| Chainguard | datadog-agent-7.80 | 7.80.4-r1 |
| Chainguard | datadog-agent-fips-7.71 | 7.71.2-r21 |
| Chainguard | datadog-agent-fips-7.72 | 7.72.4-r28 |
| Chainguard | datadog-agent-fips-7.73 | 7.73.3-r23 |
| Chainguard | datadog-agent-fips-7.74 | 7.74.1-r21 |
| Chainguard | datadog-agent-fips-7.75 | no fix |
| Chainguard | datadog-agent-fips-7.76 | 7.76.3-r26 |
| Chainguard | datadog-agent-fips-7.77 | 7.77.3-r18 |
| Chainguard | datadog-agent-fips-7.78 | 7.78.4-r9 |
| Chainguard | datadog-agent-fips-7.79 | 7.79.2-r4 |
| Chainguard | datadog-agent-fips-7.80 | 7.80.4-r2 |
| Chainguard | docker-cli-buildx | 0.35.0-r1 |
| Chainguard | docker-cli-buildx-fips | 0.35.0-r1 |
| Chainguard | docker-compose | 5.1.4-r6 |
| Chainguard | docker-compose-fips | 5.1.4-r5 |
| Chainguard | dockerd-28 | no fix |
| Chainguard | dockerd-29 | 29.6.0-r1 |
| Chainguard | dockerd-fips-28 | no fix |
| Chainguard | dockerd-fips-29 | 29.5.2-r4 |
| Chainguard | dogstatsd-7.71 | 7.71.2-r29 |
| Chainguard | dogstatsd-7.72 | 7.72.4-r31 |
| Chainguard | dogstatsd-7.73 | 7.73.3-r23 |
| Chainguard | dogstatsd-7.74 | 7.74.1-r21 |
| Chainguard | dogstatsd-7.75 | no fix |
| Chainguard | dogstatsd-7.76 | 7.76.3-r28 |
| Chainguard | dogstatsd-7.77 | 7.77.3-r17 |
| Chainguard | dogstatsd-7.78 | 7.78.4-r12 |
| Chainguard | dogstatsd-7.79 | 7.79.2-r5 |
| Chainguard | dogstatsd-7.80 | 7.80.4-r1 |
| Chainguard | eksctl | 0.227.0-r5 |
| Chainguard | envoy-gateway-1.5-egctl | 1.5.9-r2 |
| Chainguard | envoy-gateway-1.6-egctl | 1.6.7-r2 |
| Chainguard | envoy-gateway-1.7-egctl | 1.7.4-r2 |
| Chainguard | envoy-gateway-1.8-egctl | 1.8.2-r2 |
| Chainguard | envoy-gateway-egctl | 1.8.1-r2 |
| Chainguard | envoy-gateway-fips-1.5-egctl | 1.5.9-r2 |
| Chainguard | envoy-gateway-fips-1.6-egctl | 1.6.7-r2 |
| Chainguard | envoy-gateway-fips-1.7-egctl | 1.7.4-r2 |
| Chainguard | envoy-gateway-fips-1.8-egctl | 1.8.2-r2 |
| Chainguard | envoy-gateway-fips-egctl | 1.8.1-r1 |
| Chainguard | falco-no-driver | 0.45.0-r0 |
| Chainguard | filebeat-7 | no fix |
| Chainguard | filebeat-fips-7 | no fix |
| Chainguard | filebeat-oss-7 | no fix |
| Chainguard | filebeat-oss-fips-7 | no fix |
| Chainguard | fuse-overlayfs-snapshotter | 2.1.7-r17 |
| Chainguard | gatekeeper-3.20-gator | no fix |
| Chainguard | gatekeeper-3.21-gator | 3.21.1-r13 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r7 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.4-r6 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.2-r3 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.6-r6 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.4-r4 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.2-r2 |
| Chainguard | google-osconfig-agent | 20251028.00-r23 |
| Chainguard | grype | 0.114.0-r1 |
| Chainguard | grype-db | 0.54.0-r1 |
| Chainguard | grype-fips | 0.114.0-r1 |
| Chainguard | harvester | 1.8.1-r0 |
| Chainguard | harvester-fips | 1.8.1-r0 |
| Chainguard | harvester-fips-webhook | 1.8.1-r0 |
| Chainguard | harvester-webhook | 1.8.1-r0 |
| Chainguard | headlamp | 0.43.0-r1 |
| Chainguard | headlamp-fips | 0.43.0-r2 |
| Chainguard | heartbeat-7 | no fix |
| Chainguard | heartbeat-fips-7 | no fix |
| Chainguard | helm-3 | 3.22.0-r0 |
| Chainguard | helm-3 | 3.21.2-r1 |
| Chainguard | helm-exporter | 1.3.0-r11 |
| Chainguard | helm-exporter-fips | 1.3.0-r12 |
| Chainguard | helm-fips-3 | 3.21.2-r1 |
| Chainguard | helm-mapkubeapis | 0.6.1-r21 |
| Chainguard | helm-operator | 1.42.2-r13 |
| Chainguard | helm-operator-fips | 1.42.2-r6 |
| Chainguard | helm-push | 0.11.1-r16 |
| Chainguard | helm-set-status | 0.3.0-r20 |
| Chainguard | helmfile | 1.5.5-r1 |
| Chainguard | jfrog-cli | 2.109.0-r1 |
| Chainguard | k3s-1.31 | no fix |
| Chainguard | k3s-fips-1.33 | no fix |
| Chainguard | k3s-static | 1.36.2.1-r1 |
| Chainguard | k3s-static-1.31 | no fix |
| Chainguard | k3s-static-1.34 | 1.34.9.1-r1 |
| Chainguard | k3s-static-1.35 | 1.35.6.1-r1 |
| Chainguard | k8sgpt | 0.4.38-r3 |
| Chainguard | k8sgpt | no fix |
| Chainguard | k8sgpt | 0.4.34-r1 |
| Chainguard | k8ssandra-client | 0.9.1-r2 |
| Chainguard | k9s | 0.51.0-r1 |
| Chainguard | k9s | 0.51.0-r2 |
| Chainguard | k9s-fips | 0.51.0-r2 |
| Chainguard | k9s-fips | 0.51.0-r1 |
| Chainguard | kaniko | 1.25.15-r10 |
| Chainguard | kaniko | 1.25.15-r9 |
| Chainguard | kaniko-fips | 1.25.15-r7 |
| Chainguard | kaniko-fips | 1.25.15-r8 |
| Chainguard | kaniko-warmer | 1.25.15-r9 |
| Chainguard | kaniko-warmer | 1.25.15-r10 |
| Chainguard | kaniko-warmer-fips | 1.25.15-r8 |
| Chainguard | kaniko-warmer-fips | 1.25.15-r7 |
| Chainguard | kargo | 1.10.7-r1 |
| Chainguard | kgateway-2.3 | 2.3.4-r1 |
| Chainguard | kgateway-2.4 | 2.4.2-r1 |
| Chainguard | kgateway-fips-2.3 | 2.3.4-r1 |
| Chainguard | kgateway-fips-2.4 | 2.4.2-r2 |
| Chainguard | kots | 1.130.4-r8 |
| Chainguard | kube-arangodb-1.3 | no fix |
| Chainguard | kube-arangodb-1.4 | 1.4.3-r11 |
| Chainguard | kube-arangodb-fips-1.3 | no fix |
| Chainguard | kube-arangodb-fips-1.4 | 1.4.3-r6 |
| Chainguard | kube-mgmt | 11.0.7-r4 |
| Chainguard | kube-mgmt-fips | 11.0.7-r6 |
| Chainguard | kubescape | 4.0.9-r1 |
| Chainguard | kubescape-operator | 0.2.151-r1 |
| Chainguard | kubescape-operator | 0.2.172-r2 |
| Chainguard | kubescape-operator-fips | 0.2.151-r1 |
| Chainguard | kubescape-server | 4.0.9-r2 |
| Chainguard | kubescape-server-downloader | 4.0.9-r2 |
| Chainguard | kubescape-server-fips | 4.0.9-r2 |
| Chainguard | kubescape-server-fips-downloader | 4.0.9-r2 |
| Chainguard | kubevela-vela-cli | 1.10.8-r11 |
| Chainguard | kubevela-vela-cli-fips | 1.10.8-r12 |
| Chainguard | kubevela-vela-core | 1.10.8-r11 |
| Chainguard | kubevela-vela-core-fips | 1.10.8-r12 |
| Chainguard | linkerd2-cli | 26.6.3-r2 |
| Chainguard | linkerd2-controller | 26.6.3-r2 |
| Chainguard | linkerd2-controller-compat | 26.9.2-r0 |
| Chainguard | linkerd2-debug | 26.9.2-r0 |
| Chainguard | linkerd2-fips-cli | 26.6.3-r1 |
| Chainguard | linkerd2-fips-controller | 26.6.3-r1 |
| Chainguard | linkerd2-fips-metrics-api | 26.6.3-r1 |
| Chainguard | linkerd2-fips-tap | 26.6.3-r1 |
| Chainguard | linkerd2-fips-web | 26.6.3-r1 |
| Chainguard | linkerd2-metrics-api | 26.6.3-r2 |
| Chainguard | linkerd2-tap | 26.6.3-r2 |
| Chainguard | linkerd2-web | 26.6.3-r2 |
| Chainguard | livekit-cli | 2.16.4-r5 |
| Chainguard | manifest-tool | 2.2.2-r4 |
| Chainguard | metricbeat-7 | no fix |
| Chainguard | metricbeat-fips-7 | no fix |
| Chainguard | neuvector-controller | 5.5.3-r1 |
| Chainguard | neuvector-controller-fips | 5.5.3-r1 |
| Chainguard | neuvector-enforcer | 5.5.3-r1 |
| Chainguard | neuvector-enforcer-fips | 5.5.3-r1 |
| Chainguard | neuvector-scanner | 4.199-r1 |
| Chainguard | neuvector-scanner-fips | 4.199-r1 |
| Chainguard | neuvector-scanner-task | 4.199-r1 |
| Chainguard | neuvector-scanner-task-fips | 4.199-r1 |
| Chainguard | neuvector-upgrader | 5.5.3-r1 |
| Chainguard | neuvector-upgrader-fips | 5.5.3-r1 |
| Chainguard | newrelic-infrastructure-agent | 1.76.2-r1 |
| Chainguard | newrelic-infrastructure-agent-fips | 1.76.2-r1 |
| Chainguard | packer | 1.15.4-r2 |
| Chainguard | packer-fips | 1.15.4-r2 |
| Chainguard | rancher-2.12 | 2.12.10-r3 |
| Chainguard | rancher-2.13 | 2.13.6-r4 |
| Chainguard | rancher-2.14 | 2.14.2-r2 |
| Chainguard | rancher-agent-2.12 | 2.12.10-r2 |
| Chainguard | rancher-agent-2.13 | 2.13.9-r4 |
| Chainguard | rancher-agent-2.13 | 2.13.6-r2 |
| Chainguard | rancher-agent-2.14 | 2.14.2-r3 |
| Chainguard | rancher-helm-3 | 3.20.0-r15 |
| Chainguard | redpanda-operator | 26.1.6-r2 |
| Chainguard | redpanda-operator-25.1 | 25.1.4-r7 |
| Chainguard | redpanda-operator-25.2 | 25.2.6-r1 |
| Chainguard | redpanda-operator-25.3 | 25.3.7-r1 |
| Chainguard | redpanda-operator-26.1 | 26.1.6-r1 |
| Chainguard | scorecard | 5.5.0-r9 |
| Chainguard | skaffold | 2.22.0-r2 |
| Chainguard | skaffold-fips | 2.22.0-r1 |
| Chainguard | spegel | 0.7.2-r2 |
| Chainguard | spegel-fips | 0.7.2-r1 |
| Chainguard | steampipe | 2.4.4-r6 |
| Chainguard | syft | 1.45.1-r1 |
| Chainguard | syft-fips | 1.45.1-r2 |
| Chainguard | tekton-pipelines-controller-0.68 | no fix |
| Chainguard | tekton-pipelines-controller-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-entrypoint-0.68 | no fix |
| Chainguard | tekton-pipelines-entrypoint-fips-0.68 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-0.68 | no fix |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.68 | no fix |
| Chainguard | teleport-17 | 17.7.25-r3 |
| Chainguard | teleport-18 | 18.9.1-r1 |
| Chainguard | teleport-18.6 | 18.6.8-r23 |
| Chainguard | tigera-operator-1.40 | 1.40.13-r1 |
| Chainguard | tigera-operator-1.41 | 1.41.1-r15 |
| Chainguard | tigera-operator-1.42 | 1.42.2-r1 |
| Chainguard | tigera-operator-fips-1.40 | 1.40.13-r1 |
| Chainguard | tigera-operator-fips-1.41 | 1.41.1-r13 |
| Chainguard | tigera-operator-fips-1.42 | 1.42.2-r1 |
| Chainguard | trivy | 0.70.0-r7 |
| Chainguard | trivy | 0.70.0-r8 |
| Chainguard | trivy-fips | 0.70.0-r1 |
| Chainguard | trivy-fips | 0.70.0-r2 |
| Chainguard | trivy-operator | 0.30.1-r16 |
| Chainguard | trivy-operator | 0.30.1-r17 |
| Chainguard | trivy-operator-fips | 0.30.1-r14 |
| Chainguard | trivy-operator-fips | 0.30.1-r13 |
| Chainguard | tw | 0.0.49-r2 |
| Chainguard | twt | 0.0.49-r2 |
| Chainguard | upwind-agent | 0 |
| Chainguard | wolfictl | 0.39.18-r2 |
| Chainguard | xeol | 0.10.8-r46 |
| Chainguard | xeol-fips | 0.10.8-r44 |
| Chainguard | zarf | 0.79.0-r1 |
| Chainguard | zarf | 0.79.0-r2 |
| Chainguard | zarf-fips | 0.79.0-r3 |
| Chainguard | zarf-fips | 0.79.0-r2 |
| Chainguard | zot | 2.1.17-r8 |
| Chainguard | zot | 2.1.17-r7 |
| Debian:12 | containerd | no fix |
| Debian:13 | containerd | no fix |
| Debian:14 | containerd | 2.1.9+ds1-1 |
| Red Hat:hummingbird:1 | trivy | 0:0.72.0-0.1.hum1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Micro 5.3 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Micro 5.4 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Micro 5.5 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Module for Containers 15 SP7 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | containerd | 1.7.29-16.116.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | containerd | 1.7.29-16.116.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | containerd | 1.7.29-150000.149.1 |
| SUSE:Linux Micro 6.0 | containerd | 1.7.29-159998.1.1 |
| Ubuntu:22.04:LTS | containerd | 1.6.12-0ubuntu1~22.04.11 |
| Ubuntu:22.04:LTS | containerd-app | 2.2.1-0ubuntu1~22.04.2 |
| Ubuntu:24.04:LTS | containerd-app | 2.2.1-0ubuntu1~24.04.3 |
| Ubuntu:25.10 | containerd | no fix |
| Ubuntu:25.10 | containerd-app | 2.2.1-0ubuntu1~25.10.2 |
| Ubuntu:25.10 | containerd-stable | 2.1.6-0ubuntu1~25.10.2 |
| Ubuntu:26.04:LTS | containerd-app | 2.2.2-0ubuntu1.1 |
| Ubuntu:26.04:LTS | containerd-stable | 2.2.2-0ubuntu1.1 |
| Ubuntu:26.10 | containerd | no fix |
| Ubuntu:Pro:16.04:LTS | containerd | 1.2.6-0ubuntu1~16.04.6+esm7 |
| Ubuntu:Pro:18.04:LTS | containerd | 1.6.12-0ubuntu1~18.04.1+esm4 |
| Ubuntu:Pro:20.04:LTS | containerd | 1.6.12-0ubuntu1~20.04.8+esm2 |
| Ubuntu:Pro:20.04:LTS | containerd-app | 1.7.24-0ubuntu1~20.04.2+esm2 |
| Ubuntu:Pro:24.04:LTS | containerd | 1.6.24~ds1-1ubuntu1.3+esm3 |
| Ubuntu:Pro:26.04:LTS | containerd | 1.7.24~ds1-10ubuntu1+esm1 |
| Wolfi | buildctl | 0.31.0-r2 |
| Wolfi | buildkitd | 0.31.0-r2 |
| Wolfi | chartmuseum | 0.16.5-r13 |
| Wolfi | cluster-api-helm-controller | 0.6.4-r7 |
| Wolfi | consul-k8s-1.9-cli | 1.9.8-r5 |
| Wolfi | ctop | 0.7.7-r37 |
| Wolfi | dagger | 0.20.8-r9 |
| Wolfi | datadog-agent-7.72 | 7.72.4-r31 |
| Wolfi | datadog-agent-7.73 | 7.73.3-r23 |
| Wolfi | datadog-agent-7.74 | 7.74.1-r21 |
| Wolfi | datadog-agent-7.75 | no fix |
| Wolfi | datadog-agent-7.76 | no fix |
| Wolfi | datadog-agent-7.76 | 7.76.3-r28 |
| Wolfi | datadog-agent-7.76 | 7.76.3-r41 |
| Wolfi | datadog-agent-7.77 | 7.77.3-r17 |
| Wolfi | datadog-agent-7.78 | 7.78.4-r12 |
| Wolfi | datadog-agent-7.79 | 7.79.2-r5 |
| Wolfi | datadog-agent-7.80 | 7.80.4-r1 |
| Wolfi | docker-cli-buildx | 0.35.0-r1 |
| Wolfi | docker-compose | 5.1.4-r6 |
| Wolfi | dockerd-28 | no fix |
| Wolfi | dockerd-29 | 29.6.0-r1 |
| Wolfi | dogstatsd-7.72 | 7.72.4-r31 |
| Wolfi | dogstatsd-7.73 | 7.73.3-r23 |
| Wolfi | dogstatsd-7.75 | no fix |
| Wolfi | dogstatsd-7.76 | 7.76.3-r28 |
| Wolfi | dogstatsd-7.77 | 7.77.3-r17 |
| Wolfi | dogstatsd-7.78 | 7.78.4-r12 |
| Wolfi | dogstatsd-7.79 | 7.79.2-r5 |
| Wolfi | dogstatsd-7.80 | 7.80.4-r1 |
| Wolfi | eksctl | 0.227.0-r5 |
| Wolfi | envoy-gateway-egctl | 1.8.1-r2 |
| Wolfi | falco-no-driver | 0.45.0-r0 |
| Wolfi | fuse-overlayfs-snapshotter | 2.1.7-r17 |
| Wolfi | gatekeeper-3.21-gator | 3.21.1-r13 |
| Wolfi | grype | 0.114.0-r1 |
| Wolfi | headlamp | 0.43.0-r1 |
| Wolfi | helm-3 | 3.21.2-r1 |
| Wolfi | helm-3 | 3.22.0-r0 |
| Wolfi | helm-mapkubeapis | 0.6.1-r21 |
| Wolfi | helm-operator | 1.42.2-r13 |
| Wolfi | helm-push | 0.11.1-r16 |
| Wolfi | helm-set-status | 0.3.0-r20 |
| Wolfi | k3s-static | 1.36.2.1-r1 |
| Wolfi | k3s-static-1.34 | 1.34.9.1-r1 |
| Wolfi | k3s-static-1.35 | 1.35.6.1-r1 |
| Wolfi | k8sgpt | 0.4.34-r1 |
| Wolfi | k8sgpt | no fix |
| Wolfi | k8sgpt | 0.4.38-r3 |
| Wolfi | k8ssandra-client | 0.9.1-r2 |
| Wolfi | k9s | 0.51.0-r2 |
| Wolfi | k9s | 0.51.0-r1 |
| Wolfi | kaniko | 1.25.15-r9 |
| Wolfi | kaniko | 1.25.15-r10 |
| Wolfi | kaniko-warmer | 1.25.15-r10 |
| Wolfi | kaniko-warmer | 1.25.15-r9 |
| Wolfi | kargo | 1.10.7-r1 |
| Wolfi | kots | 1.130.4-r8 |
| Wolfi | kube-arangodb-1.4 | 1.4.3-r11 |
| Wolfi | kubescape | 4.0.9-r1 |
| Wolfi | kubescape-operator | 0.2.172-r2 |
| Wolfi | kubescape-operator | 0.2.151-r1 |
| Wolfi | kubevela-vela-cli | 1.10.8-r11 |
| Wolfi | kubevela-vela-core | 1.10.8-r11 |
| Wolfi | linkerd2-cli | 26.6.3-r2 |
| Wolfi | linkerd2-controller | 26.6.3-r2 |
| Wolfi | linkerd2-controller-compat | 26.9.2-r0 |
| Wolfi | linkerd2-debug | 26.9.2-r0 |
| Wolfi | linkerd2-metrics-api | 26.6.3-r2 |
| Wolfi | linkerd2-tap | 26.6.3-r2 |
| Wolfi | linkerd2-web | 26.6.3-r2 |
| Wolfi | manifest-tool | 2.2.2-r4 |
| Wolfi | neuvector-scanner | 4.199-r1 |
| Wolfi | neuvector-scanner-task | 4.199-r1 |
| Wolfi | newrelic-infrastructure-agent | 1.76.2-r1 |
| Wolfi | rancher-2.13 | 2.13.6-r4 |
| Wolfi | rancher-2.14 | 2.14.2-r2 |
| Wolfi | rancher-agent-2.13 | 2.13.9-r4 |
| Wolfi | rancher-agent-2.13 | 2.13.6-r2 |
| Wolfi | rancher-agent-2.14 | 2.14.2-r3 |
| Wolfi | rancher-helm-3 | 3.20.0-r15 |
| Wolfi | scorecard | 5.5.0-r9 |
| Wolfi | skaffold | 2.22.0-r2 |
| Wolfi | spegel | 0.7.2-r2 |
| Wolfi | steampipe | 2.4.4-r6 |
| Wolfi | syft | 1.45.1-r1 |
| Wolfi | teleport-18.6 | 18.6.8-r23 |
| Wolfi | tigera-operator-1.40 | 1.40.13-r1 |
| Wolfi | tigera-operator-1.41 | 1.41.1-r15 |
| Wolfi | tigera-operator-1.42 | 1.42.2-r1 |
| Wolfi | trivy | 0.70.0-r7 |
| Wolfi | trivy | 0.70.0-r8 |
| Wolfi | trivy-operator | 0.30.1-r17 |
| Wolfi | trivy-operator | 0.30.1-r16 |
| Wolfi | tw | 0.0.49-r2 |
| Wolfi | twt | 0.0.49-r2 |
| Wolfi | wolfictl | 0.39.18-r2 |
| Wolfi | xeol | 0.10.8-r46 |
| Wolfi | zarf | 0.79.0-r1 |
| Wolfi | zarf | 0.79.0-r2 |
| Wolfi | zot | 2.1.17-r8 |
| Wolfi | zot | 2.1.17-r7 |
| openSUSE:Leap 16.0 | containerd | 1.7.33-160000.1.1 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Leap 16.0 | trivy | 0.71.2-160000.1.1 |
| openSUSE:Tumbleweed | containerd | 1.7.33-1.1 |
| openSUSE:Tumbleweed | trivy | 0.71.2-1.1 |