CVE-2026-53492
Fixed in a distro release EPSS <1%CVSS 8.4
containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | no fix |
| Go | github.com/containerd/containerd/v2 | 2.1.9 |
| Go | github.com/containerd/containerd/v2 | 2.2.5 |
| Go | github.com/containerd/containerd/v2 | 2.3.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | amazon-ecs-agent | 1.105.0-r0 |
| Chainguard | amazon-ecs-agent-fips | 1.105.0-r0 |
| Chainguard | auditbeat-7 | 7.17.29-r18 |
| Chainguard | auditbeat-fips-7 | 7.17.29-r20 |
| Chainguard | buildctl | 0.31.0-r2 |
| Chainguard | buildctl-fips | 0.31.0-r1 |
| Chainguard | buildkitd | 0.31.0-r2 |
| Chainguard | buildkitd-fips | 0.31.0-r1 |
| Chainguard | cg | 0.2.295-r2 |
| Chainguard | chainctl | 0.2.289-r1 |
| Chainguard | chainctl-fips | 0.2.289-r1 |
| Chainguard | chaos-mesh | 2.8.3-r3 |
| Chainguard | chaos-mesh-daemon | 2.8.3-r3 |
| Chainguard | chaos-mesh-dashboard | 2.8.3-r3 |
| Chainguard | chaos-mesh-fips | 2.8.3-r2 |
| Chainguard | chaos-mesh-fips-daemon | 2.8.3-r2 |
| Chainguard | chaos-mesh-fips-dashboard | 2.8.3-r2 |
| Chainguard | chartmuseum | 0.16.5-r15 |
| Chainguard | chartmuseum-fips | 0.16.5-r15 |
| Chainguard | cloudbeat-8.17 | 8.17.10-r27 |
| Chainguard | cloudbeat-8.19 | 8.19.16-r2 |
| Chainguard | cloudbeat-9.0 | 9.0.8-r28 |
| Chainguard | cloudbeat-9.1 | 9.1.10-r20 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r8 |
| Chainguard | cloudbeat-9.3 | 9.3.5-r2 |
| Chainguard | cloudbeat-9.4 | 9.4.2-r2 |
| Chainguard | cloudbeat-fips-8.17 | 8.17.10-r32 |
| Chainguard | cloudbeat-fips-8.19 | 8.19.16-r1 |
| Chainguard | cloudbeat-fips-9.0 | 9.0.8-r31 |
| Chainguard | cloudbeat-fips-9.1 | 9.1.10-r24 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r7 |
| Chainguard | cloudbeat-fips-9.3 | 9.3.5-r2 |
| Chainguard | cloudbeat-fips-9.4 | 9.4.2-r4 |
| Chainguard | cluster-api-helm-controller | 0.6.4-r8 |
| Chainguard | cluster-api-helm-controller-fips | 0.6.4-r7 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.2 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.3 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.4 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.5 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.5 | no fix |
| Chainguard | consul-k8s-1.1-cli | 1.1.18-r40 |
| Chainguard | consul-k8s-1.3-cli | 1.3.9-r46 |
| Chainguard | consul-k8s-1.3-cli | 1.3.9-r47 |
| Chainguard | consul-k8s-1.4-cli | 1.4.10-r32 |
| Chainguard | consul-k8s-1.5-cli | 1.5.9-r30 |
| Chainguard | consul-k8s-1.6-cli | 1.6.10-r24 |
| Chainguard | consul-k8s-1.7-cli | 1.7.13-r14 |
| Chainguard | consul-k8s-1.9-cli | 1.9.9-r0 |
| Chainguard | consul-k8s-2.0-cli | 2.0.1-r2 |
| Chainguard | consul-k8s-2.0-cli | 2.0.1-r1 |
| Chainguard | consul-k8s-fips-1.1-cli | 1.1.18-r40 |
| Chainguard | consul-k8s-fips-1.1-cli | 1.1.18-r39 |
| Chainguard | consul-k8s-fips-1.3-cli | 1.3.9-r43 |
| Chainguard | consul-k8s-fips-1.4-cli | 1.4.10-r31 |
| Chainguard | consul-k8s-fips-1.5-cli | 1.5.9-r32 |
| Chainguard | consul-k8s-fips-1.6-cli | 1.6.10-r25 |
| Chainguard | consul-k8s-fips-1.7-cli | 1.7.13-r17 |
| Chainguard | consul-k8s-fips-1.9-cli | 1.9.9-r1 |
| Chainguard | consul-k8s-fips-2.0-cli | 2.0.1-r2 |
| Chainguard | containerd-1 | 1.7.33-r1 |
| Chainguard | containerd-shim-runc-v2-1 | 1.7.33-r1 |
| Chainguard | containerd-stress-1 | 1.7.33-r1 |
| Chainguard | crossplane-2.3-crank | 2.3.3-r4 |
| Chainguard | crossplane-2.4-crank | no fix |
| Chainguard | crossplane-cli-2.3 | no fix |
| Chainguard | crossplane-cli-2.4 | no fix |
| Chainguard | crossplane-cli-fips-2.3 | no fix |
| Chainguard | crossplane-cli-fips-2.4 | no fix |
| Chainguard | crossplane-fips-2.3-crank | 2.3.3-r1 |
| Chainguard | crossplane-fips-2.4-crank | no fix |
| Chainguard | ctop | 0.7.7-r38 |
| Chainguard | ctr-1 | 1.7.33-r1 |
| Chainguard | dagger | 0.20.8-r9 |
| Chainguard | datadog-agent-7.71 | 7.71.2-r27 |
| Chainguard | datadog-agent-7.72 | 7.72.4-r30 |
| Chainguard | datadog-agent-7.73 | 7.73.3-r19 |
| Chainguard | datadog-agent-7.74 | 7.74.1-r21 |
| Chainguard | datadog-agent-7.75 | 7.75.4-r9 |
| Chainguard | datadog-agent-7.76 | 7.76.3-r41 |
| Chainguard | datadog-agent-7.76 | 7.76.3-r28 |
| Chainguard | datadog-agent-7.76 | no fix |
| Chainguard | datadog-agent-7.77 | 7.77.3-r18 |
| Chainguard | datadog-agent-7.78 | 7.78.4-r12 |
| Chainguard | datadog-agent-7.79 | 7.79.2-r8 |
| Chainguard | datadog-agent-7.80 | no fix |
| Chainguard | datadog-agent-7.81 | no fix |
| Chainguard | datadog-agent-fips-7.71 | 7.71.2-r20 |
| Chainguard | datadog-agent-fips-7.72 | 7.72.4-r22 |
| Chainguard | datadog-agent-fips-7.73 | 7.73.3-r23 |
| Chainguard | datadog-agent-fips-7.74 | 7.74.1-r22 |
| Chainguard | datadog-agent-fips-7.75 | 7.75.4-r9 |
| Chainguard | datadog-agent-fips-7.76 | 7.76.3-r27 |
| Chainguard | datadog-agent-fips-7.77 | 7.77.3-r20 |
| Chainguard | datadog-agent-fips-7.78 | 7.78.4-r10 |
| Chainguard | datadog-agent-fips-7.79 | 7.79.2-r3 |
| Chainguard | datadog-agent-fips-7.80 | no fix |
| Chainguard | datadog-agent-fips-7.81 | no fix |
| Chainguard | docker-cli-buildx | 0.35.0-r1 |
| Chainguard | docker-cli-buildx-fips | 0.35.0-r1 |
| Chainguard | docker-compose | 5.1.4-r6 |
| Chainguard | docker-compose-fips | 5.1.4-r5 |
| Chainguard | dockerd-28 | no fix |
| Chainguard | dockerd-29 | 29.6.0-r1 |
| Chainguard | dockerd-fips-28 | no fix |
| Chainguard | dockerd-fips-29 | 29.5.2-r4 |
| Chainguard | dogstatsd-7.71 | 7.71.2-r27 |
| Chainguard | dogstatsd-7.72 | 7.72.4-r30 |
| Chainguard | dogstatsd-7.73 | 7.73.3-r19 |
| Chainguard | dogstatsd-7.74 | 7.74.1-r21 |
| Chainguard | dogstatsd-7.75 | 7.75.4-r9 |
| Chainguard | dogstatsd-7.76 | 7.76.3-r41 |
| Chainguard | dogstatsd-7.76 | 7.76.3-r28 |
| Chainguard | dogstatsd-7.77 | 7.77.3-r18 |
| Chainguard | dogstatsd-7.78 | 7.78.4-r12 |
| Chainguard | dogstatsd-7.79 | 7.79.2-r8 |
| Chainguard | dogstatsd-7.80 | no fix |
| Chainguard | dogstatsd-7.81 | no fix |
| Chainguard | eksctl | 0.229.0-r1 |
| Chainguard | envoy-gateway-1.5-egctl | no fix |
| Chainguard | envoy-gateway-1.6-egctl | no fix |
| Chainguard | envoy-gateway-1.7-egctl | no fix |
| Chainguard | envoy-gateway-1.8-egctl | 1.8.3-r0 |
| Chainguard | envoy-gateway-egctl | 1.8.2-r0 |
| Chainguard | envoy-gateway-fips-1.5-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.6-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.7-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.8-egctl | 1.8.3-r0 |
| Chainguard | envoy-gateway-fips-egctl | 1.8.2-r0 |
| Chainguard | falco-no-driver | 0.45.0-r0 |
| Chainguard | filebeat-7 | 7.17.29-r18 |
| Chainguard | filebeat-fips-7 | 7.17.29-r20 |
| Chainguard | filebeat-oss-7 | 7.17.29-r18 |
| Chainguard | filebeat-oss-fips-7 | 7.17.29-r20 |
| Chainguard | fuse-overlayfs-snapshotter | 2.1.7-r17 |
| Chainguard | gatekeeper-3.20-gator | 3.20.1-r12 |
| Chainguard | gatekeeper-3.21-gator | 3.21.1-r14 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r13 |
| Chainguard | gitlab-rails-ce-18.10 | 18.10.8-r2 |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r3 |
| Chainguard | gitlab-rails-ce-18.5 | 18.5.7-r1 |
| Chainguard | gitlab-rails-ce-18.6 | 18.6.8-r2 |
| Chainguard | gitlab-rails-ce-18.7 | 18.7.7-r2 |
| Chainguard | gitlab-rails-ce-18.8 | 18.8.11-r1 |
| Chainguard | gitlab-rails-ce-18.9 | 18.9.8-r3 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.3-r3 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.1-r3 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.1-r4 |
| Chainguard | gitlab-rails-ce-19.2 | no fix |
| Chainguard | gitlab-rails-ce-19.3 | no fix |
| Chainguard | gitlab-rails-ce-19.4 | no fix |
| Chainguard | gitlab-rails-ce-19.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r16 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r3 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.6-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 18.5.7-r1 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 18.6.8-r2 |
| Chainguard | gitlab-rails-ce-fips-18.7 | 18.7.7-r2 |
| Chainguard | gitlab-rails-ce-fips-18.8 | 18.8.11-r1 |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r1 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.3-r2 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r2 |
| Chainguard | gitlab-rails-ce-fips-19.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.4 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.5 | no fix |
| Chainguard | google-osconfig-agent | 20251028.00-r24 |
| Chainguard | grype | 0.114.0-r1 |
| Chainguard | grype-db | 0.54.0-r1 |
| Chainguard | grype-fips | 0.114.0-r1 |
| Chainguard | harvester | 1.8.1-r1 |
| Chainguard | harvester-fips | 1.8.1-r0 |
| Chainguard | harvester-fips-webhook | 1.8.1-r0 |
| Chainguard | harvester-webhook | 1.8.1-r1 |
| Chainguard | headlamp | 0.43.0-r3 |
| Chainguard | headlamp-fips | 0.43.0-r4 |
| Chainguard | heartbeat-7 | 7.17.29-r18 |
| Chainguard | heartbeat-fips-7 | 7.17.29-r20 |
| Chainguard | helm-3 | 3.22.0-r0 |
| Chainguard | helm-3 | 3.21.2-r2 |
| Chainguard | helm-exporter | 1.3.0-r13 |
| Chainguard | helm-exporter-fips | 1.3.0-r14 |
| Chainguard | helm-fips-3 | 3.21.2-r2 |
| Chainguard | helm-mapkubeapis | 0.6.1-r21 |
| Chainguard | helm-operator | 1.42.3-r0 |
| Chainguard | helm-operator-fips | 1.42.3-r1 |
| Chainguard | helm-operator-fips | 1.42.3-r2 |
| Chainguard | helm-push | 0.11.1-r16 |
| Chainguard | helm-set-status | 0.3.0-r21 |
| Chainguard | helmfile | 1.6.0-r2 |
| Chainguard | jfrog-cli | 2.111.0-r1 |
| Chainguard | jfrog-cli | 2.112.0-r0 |
| Chainguard | k3s-fips-1.33 | no fix |
| Chainguard | k3s-static | 1.36.2.1-r1 |
| Chainguard | k3s-static-1.34 | 1.34.9.1-r1 |
| Chainguard | k3s-static-1.35 | 1.35.6.1-r1 |
| Chainguard | k8sgpt | 0.4.38-r3 |
| Chainguard | k8sgpt | 0.4.35-r0 |
| Chainguard | k8ssandra-client | 0.9.1-r2 |
| Chainguard | k9s | 0.51.0-r1 |
| Chainguard | k9s-fips | 0.51.0-r1 |
| Chainguard | kaniko | 1.25.15-r9 |
| Chainguard | kaniko-fips | 1.25.15-r7 |
| Chainguard | kaniko-warmer | 1.25.15-r9 |
| Chainguard | kaniko-warmer-fips | 1.25.15-r7 |
| Chainguard | kargo | 1.10.8-r1 |
| Chainguard | kargo-1.10 | 0 |
| Chainguard | kargo-1.11 | 0 |
| Chainguard | kargo-1.8 | 0 |
| Chainguard | kargo-1.9 | 0 |
| Chainguard | kgateway-2.3 | 2.3.5-r2 |
| Chainguard | kgateway-2.3 | 2.3.5-r3 |
| Chainguard | kgateway-2.4 | no fix |
| Chainguard | kgateway-fips-2.3 | 2.3.5-r1 |
| Chainguard | kgateway-fips-2.4 | no fix |
| Chainguard | kots | 1.130.6-r0 |
| Chainguard | kube-arangodb-1.3 | 1.3.4-r9 |
| Chainguard | kube-arangodb-1.4 | 1.4.3-r14 |
| Chainguard | kube-arangodb-1.4 | 1.4.3-r13 |
| Chainguard | kube-arangodb-fips-1.3 | 1.3.4-r8 |
| Chainguard | kube-arangodb-fips-1.4 | 1.4.3-r7 |
| Chainguard | kube-arangodb-fips-1.4 | 1.4.3-r8 |
| Chainguard | kube-mgmt | 11.0.7-r4 |
| Chainguard | kube-mgmt-fips | 11.0.7-r6 |
| Chainguard | kubescape | 4.0.9-r1 |
| Chainguard | kubescape-operator | 0.2.172-r2 |
| Chainguard | kubescape-operator | 0.2.151-r4 |
| Chainguard | kubescape-operator-fips | 0.2.151-r6 |
| Chainguard | kubescape-server | 4.0.9-r2 |
| Chainguard | kubescape-server-downloader | 4.0.9-r2 |
| Chainguard | kubescape-server-fips | 4.0.9-r2 |
| Chainguard | kubescape-server-fips-downloader | 4.0.9-r2 |
| Chainguard | kubevela-vela-cli | 1.10.9-r0 |
| Chainguard | kubevela-vela-cli-fips | 1.10.9-r0 |
| Chainguard | kubevela-vela-core | 1.10.9-r0 |
| Chainguard | kubevela-vela-core-fips | 1.10.9-r0 |
| Chainguard | linkerd2-cli | 26.6.3-r2 |
| Chainguard | linkerd2-controller | 26.6.3-r2 |
| Chainguard | linkerd2-controller-compat | no fix |
| Chainguard | linkerd2-debug | 26.9.2-r0 |
| Chainguard | linkerd2-fips-cli | 26.6.3-r3 |
| Chainguard | linkerd2-fips-controller | 26.6.3-r3 |
| Chainguard | linkerd2-fips-metrics-api | 26.6.3-r4 |
| Chainguard | linkerd2-fips-metrics-api | 26.6.3-r3 |
| Chainguard | linkerd2-fips-tap | 26.6.3-r3 |
| Chainguard | linkerd2-fips-web | 26.6.3-r4 |
| Chainguard | linkerd2-fips-web | 26.6.3-r3 |
| Chainguard | linkerd2-metrics-api | 26.6.3-r2 |
| Chainguard | linkerd2-tap | 26.6.3-r2 |
| Chainguard | linkerd2-web | 26.6.3-r2 |
| Chainguard | livekit-cli | 2.16.4-r5 |
| Chainguard | manifest-tool | 2.2.2-r4 |
| Chainguard | metricbeat-7 | 7.17.29-r18 |
| Chainguard | metricbeat-fips-7 | 7.17.29-r20 |
| Chainguard | neuvector-controller | 5.5.3-r1 |
| Chainguard | neuvector-controller-fips | 5.5.3-r1 |
| Chainguard | neuvector-enforcer | 5.5.3-r1 |
| Chainguard | neuvector-enforcer-fips | 5.5.3-r1 |
| Chainguard | neuvector-scanner | 4.199-r1 |
| Chainguard | neuvector-scanner-fips | 4.199-r1 |
| Chainguard | neuvector-scanner-task | 4.199-r1 |
| Chainguard | neuvector-scanner-task-fips | 4.199-r1 |
| Chainguard | neuvector-upgrader | 5.5.3-r1 |
| Chainguard | neuvector-upgrader-fips | 5.5.3-r1 |
| Chainguard | newrelic-infrastructure-agent | 1.77.1-r0 |
| Chainguard | newrelic-infrastructure-agent-fips | 1.77.1-r1 |
| Chainguard | packer | 1.15.4-r2 |
| Chainguard | packer-fips | 1.15.4-r2 |
| Chainguard | rancher-2.10 | 2.10.12-r1 |
| Chainguard | rancher-2.11 | 2.11.15-r0 |
| Chainguard | rancher-2.12 | 2.12.11-r1 |
| Chainguard | rancher-2.13 | 2.13.7-r0 |
| Chainguard | rancher-2.14 | 2.14.3-r1 |
| Chainguard | rancher-agent-2.10 | 2.10.12-r1 |
| Chainguard | rancher-agent-2.11 | 2.11.15-r0 |
| Chainguard | rancher-agent-2.12 | 2.12.11-r0 |
| Chainguard | rancher-agent-2.13 | 2.13.9-r4 |
| Chainguard | rancher-agent-2.13 | 2.13.7-r0 |
| Chainguard | rancher-agent-2.14 | 2.14.3-r0 |
| Chainguard | rancher-agent-2.9 | 2.9.12-r15 |
| Chainguard | rancher-helm-3 | 3.20.0-r15 |
| Chainguard | redpanda-operator | 26.1.7-r0 |
| Chainguard | redpanda-operator-25.1 | 25.1.4-r7 |
| Chainguard | redpanda-operator-25.2 | 25.2.6-r2 |
| Chainguard | redpanda-operator-25.3 | 25.3.7-r3 |
| Chainguard | redpanda-operator-26.1 | 26.1.7-r0 |
| Chainguard | redpanda-operator-26.2 | no fix |
| Chainguard | scorecard | 5.5.0-r10 |
| Chainguard | skaffold | 2.23.0-r0 |
| Chainguard | skaffold-fips | 2.23.0-r0 |
| Chainguard | spegel | 0.7.2-r2 |
| Chainguard | spegel-fips | 0.7.2-r1 |
| Chainguard | steampipe | 2.4.4-r7 |
| Chainguard | syft | 1.45.1-r1 |
| Chainguard | syft-fips | 1.45.1-r2 |
| Chainguard | tekton-pipelines-controller-0.68 | 0.68.1-r22 |
| Chainguard | tekton-pipelines-controller-fips-0.68 | 0.68.1-r24 |
| Chainguard | tekton-pipelines-entrypoint-0.68 | 0.68.1-r22 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.68 | 0.68.1-r24 |
| Chainguard | tekton-pipelines-sidecarlogresults-0.68 | 0.68.1-r22 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips-0.68 | 0.68.1-r24 |
| Chainguard | teleport-17 | 17.7.26-r1 |
| Chainguard | teleport-18 | 18.9.2-r1 |
| Chainguard | teleport-18.6 | 18.6.8-r30 |
| Chainguard | tigera-operator-1.40 | 1.40.13-r1 |
| Chainguard | tigera-operator-1.41 | 1.41.1-r16 |
| Chainguard | tigera-operator-1.42 | 1.42.3-r0 |
| Chainguard | tigera-operator-fips-1.40 | 1.40.13-r1 |
| Chainguard | tigera-operator-fips-1.41 | 1.41.1-r13 |
| Chainguard | tigera-operator-fips-1.42 | 1.42.3-r1 |
| Chainguard | trivy | 0.70.0-r7 |
| Chainguard | trivy-fips | 0.70.0-r1 |
| Chainguard | trivy-operator | 0.30.1-r16 |
| Chainguard | trivy-operator-fips | 0.30.1-r13 |
| Chainguard | tw | 0.0.50-r0 |
| Chainguard | twt | 0.0.50-r0 |
| Chainguard | upwind-agent | 0 |
| Chainguard | wazuh-manager-filebeat-oss | 0 |
| Chainguard | wazuh-manager-filebeat-oss-fips | 0 |
| Chainguard | wolfictl | 0.39.18-r2 |
| Chainguard | xeol | 0.10.8-r47 |
| Chainguard | xeol-fips | 0.10.8-r46 |
| Chainguard | zarf | 0.79.0-r1 |
| Chainguard | zarf-fips | 0.79.0-r2 |
| Chainguard | zot | 2.1.17-r7 |
| Debian:14 | containerd | 2.1.9+ds1-1 |
| Red Hat:hummingbird:1 | grype | 0:0.115.0-0.1.hum1 |
| Red Hat:hummingbird:1 | syft | 0:1.46.0-0.1.hum1 |
| Red Hat:hummingbird:1 | trivy | 0:0.69.3-1.2.hum1 |
| Ubuntu:22.04:LTS | containerd-app | 2.2.1-0ubuntu1~22.04.2 |
| Ubuntu:24.04:LTS | containerd-app | 2.2.1-0ubuntu1~24.04.3 |
| Ubuntu:25.10 | containerd-app | 2.2.1-0ubuntu1~25.10.2 |
| Ubuntu:25.10 | containerd-stable | 2.1.6-0ubuntu1~25.10.2 |
| Ubuntu:26.04:LTS | containerd-app | 2.2.2-0ubuntu1.1 |
| Ubuntu:26.04:LTS | containerd-stable | 2.2.2-0ubuntu1.1 |
| Ubuntu:Pro:20.04:LTS | containerd-app | 1.7.24-0ubuntu1~20.04.2+esm2 |
| Wolfi | buildctl | 0.31.0-r2 |
| Wolfi | buildkitd | 0.31.0-r2 |
| Wolfi | chartmuseum | 0.16.5-r15 |
| Wolfi | cluster-api-helm-controller | 0.6.4-r8 |
| Wolfi | consul-k8s-1.9-cli | 1.9.9-r0 |
| Wolfi | containerd-1 | 1.7.33-r1 |
| Wolfi | containerd-shim-runc-v2-1 | 1.7.33-r1 |
| Wolfi | containerd-stress-1 | 1.7.33-r1 |
| Wolfi | ctop | 0.7.7-r38 |
| Wolfi | ctr-1 | 1.7.33-r1 |
| Wolfi | dagger | 0.20.8-r9 |
| Wolfi | datadog-agent-7.72 | 7.72.4-r30 |
| Wolfi | datadog-agent-7.73 | 7.73.3-r19 |
| Wolfi | datadog-agent-7.74 | 7.74.1-r21 |
| Wolfi | datadog-agent-7.75 | 7.75.4-r9 |
| Wolfi | datadog-agent-7.76 | 7.76.3-r41 |
| Wolfi | datadog-agent-7.76 | no fix |
| Wolfi | datadog-agent-7.76 | 7.76.3-r28 |
| Wolfi | datadog-agent-7.77 | 7.77.3-r18 |
| Wolfi | datadog-agent-7.78 | 7.78.4-r12 |
| Wolfi | datadog-agent-7.79 | 7.79.2-r8 |
| Wolfi | datadog-agent-7.80 | no fix |
| Wolfi | datadog-agent-7.81 | no fix |
| Wolfi | docker-cli-buildx | 0.35.0-r1 |
| Wolfi | docker-compose | 5.1.4-r6 |
| Wolfi | dockerd-28 | no fix |
| Wolfi | dockerd-29 | 29.6.0-r1 |
| Wolfi | dogstatsd-7.72 | 7.72.4-r30 |
| Wolfi | dogstatsd-7.73 | 7.73.3-r19 |
| Wolfi | dogstatsd-7.75 | 7.75.4-r9 |
| Wolfi | dogstatsd-7.76 | 7.76.3-r28 |
| Wolfi | dogstatsd-7.76 | 7.76.3-r41 |
| Wolfi | dogstatsd-7.77 | 7.77.3-r18 |
| Wolfi | dogstatsd-7.78 | 7.78.4-r12 |
| Wolfi | dogstatsd-7.79 | 7.79.2-r8 |
| Wolfi | dogstatsd-7.80 | no fix |
| Wolfi | dogstatsd-7.81 | no fix |
| Wolfi | eksctl | 0.229.0-r1 |
| Wolfi | envoy-gateway-egctl | 1.8.2-r0 |
| Wolfi | falco-no-driver | 0.45.0-r0 |
| Wolfi | fuse-overlayfs-snapshotter | 2.1.7-r17 |
| Wolfi | gatekeeper-3.21-gator | 3.21.1-r14 |
| Wolfi | grype | 0.114.0-r1 |
| Wolfi | headlamp | 0.43.0-r3 |
| Wolfi | helm-3 | 3.21.2-r2 |
| Wolfi | helm-3 | 3.22.0-r0 |
| Wolfi | helm-mapkubeapis | 0.6.1-r21 |
| Wolfi | helm-operator | 1.42.3-r0 |
| Wolfi | helm-push | 0.11.1-r16 |
| Wolfi | helm-set-status | 0.3.0-r21 |
| Wolfi | k3s-static | 1.36.2.1-r1 |
| Wolfi | k3s-static-1.34 | 1.34.9.1-r1 |
| Wolfi | k3s-static-1.35 | 1.35.6.1-r1 |
| Wolfi | k8sgpt | 0.4.38-r3 |
| Wolfi | k8sgpt | 0.4.35-r0 |
| Wolfi | k8ssandra-client | 0.9.1-r2 |
| Wolfi | k9s | 0.51.0-r1 |
| Wolfi | kaniko | 1.25.15-r9 |
| Wolfi | kaniko-warmer | 1.25.15-r9 |
| Wolfi | kargo | 1.10.8-r1 |
| Wolfi | kargo-1.10 | 0 |
| Wolfi | kots | 1.130.6-r0 |
| Wolfi | kube-arangodb-1.4 | 1.4.3-r13 |
| Wolfi | kube-arangodb-1.4 | 1.4.3-r14 |
| Wolfi | kubescape | 4.0.9-r1 |
| Wolfi | kubescape-operator | 0.2.151-r4 |
| Wolfi | kubescape-operator | 0.2.172-r2 |
| Wolfi | kubevela-vela-cli | 1.10.9-r0 |
| Wolfi | kubevela-vela-core | 1.10.9-r0 |
| Wolfi | linkerd2-cli | 26.6.3-r2 |
| Wolfi | linkerd2-controller | 26.6.3-r2 |
| Wolfi | linkerd2-controller-compat | no fix |
| Wolfi | linkerd2-debug | 26.9.2-r0 |
| Wolfi | linkerd2-metrics-api | 26.6.3-r2 |
| Wolfi | linkerd2-tap | 26.6.3-r2 |
| Wolfi | linkerd2-web | 26.6.3-r2 |
| Wolfi | manifest-tool | 2.2.2-r4 |
| Wolfi | neuvector-scanner | 4.199-r1 |
| Wolfi | neuvector-scanner-task | 4.199-r1 |
| Wolfi | newrelic-infrastructure-agent | 1.77.1-r0 |
| Wolfi | rancher-2.13 | 2.13.7-r0 |
| Wolfi | rancher-2.14 | 2.14.3-r1 |
| Wolfi | rancher-agent-2.13 | 2.13.7-r0 |
| Wolfi | rancher-agent-2.13 | 2.13.9-r4 |
| Wolfi | rancher-agent-2.14 | 2.14.3-r0 |
| Wolfi | rancher-helm-3 | 3.20.0-r15 |
| Wolfi | scorecard | 5.5.0-r10 |
| Wolfi | skaffold | 2.23.0-r0 |
| Wolfi | spegel | 0.7.2-r2 |
| Wolfi | steampipe | 2.4.4-r7 |
| Wolfi | syft | 1.45.1-r1 |
| Wolfi | teleport-18.6 | 18.6.8-r30 |
| Wolfi | tigera-operator-1.40 | 1.40.13-r1 |
| Wolfi | tigera-operator-1.41 | 1.41.1-r16 |
| Wolfi | tigera-operator-1.42 | 1.42.3-r0 |
| Wolfi | trivy | 0.70.0-r7 |
| Wolfi | trivy-operator | 0.30.1-r16 |
| Wolfi | tw | 0.0.50-r0 |
| Wolfi | twt | 0.0.50-r0 |
| Wolfi | wolfictl | 0.39.18-r2 |
| Wolfi | xeol | 0.10.8-r47 |
| Wolfi | zarf | 0.79.0-r1 |
| Wolfi | zot | 2.1.17-r7 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE:Leap 16.0 | trivy | 0.71.2-160000.1.1 |
| openSUSE:Tumbleweed | trivy | 0.71.2-1.1 |