CVE-2026-95838
Fixed in a distro release EPSS <1%CVSS 4.6
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | 1.7.35 |
| Go | github.com/containerd/containerd/v2 | 2.0.12 |
| Go | github.com/containerd/containerd/v2 | 2.2.8 |
| Go | github.com/containerd/containerd/v2 | 2.3.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-gitlab-rails-ee-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | no fix |
| Chainguard | datadog-agent-7.82 | no fix |
| Chainguard | dogstatsd-7.82 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | no fix |
| Chainguard | gitlab-rails-ce-19.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.11 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.0 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.1 | no fix |
| Chainguard | k3s-1.31 | no fix |
| Chainguard | k3s-fips-1.33 | no fix |
| Chainguard | k3s-fips-1.34 | no fix |
| Chainguard | k3s-fips-1.35 | 1.35.9.1-r1 |
| Chainguard | k3s-fips-1.36 | 1.36.5.1-r3 |
| Chainguard | k3s-fips-1.37 | 1.37.1.1-r1 |
| Chainguard | k3s-static-1.31 | no fix |
| Chainguard | rancher-2.10 | no fix |
| Chainguard | rancher-2.11 | no fix |
| Chainguard | rancher-agent-2.10 | no fix |
| Chainguard | rancher-agent-2.11 | 0 |
| Chainguard | upwind-agent | no fix |
| Debian:12 | containerd | no fix |
| Debian:13 | containerd | no fix |
| Debian:14 | containerd | no fix |
| Ubuntu:22.04:LTS | containerd | no fix |
| Ubuntu:24.04:LTS | containerd-app | no fix |
| Ubuntu:26.04:LTS | containerd-app | no fix |
| Ubuntu:26.04:LTS | containerd-stable | no fix |
| Ubuntu:26.10 | containerd | no fix |
| Ubuntu:26.10 | containerd-app | no fix |
| Ubuntu:26.10 | containerd-stable | no fix |
| Ubuntu:Pro:16.04:LTS | containerd | no fix |
| Ubuntu:Pro:18.04:LTS | containerd | no fix |
| Ubuntu:Pro:20.04:LTS | containerd | no fix |
| Ubuntu:Pro:20.04:LTS | containerd-app | no fix |
| Ubuntu:Pro:22.04:LTS | containerd-app | no fix |
| Ubuntu:Pro:24.04:LTS | containerd | no fix |
| Ubuntu:Pro:26.04:LTS | containerd | no fix |
| openSUSE:Tumbleweed | google-osconfig-agent | 20261015.00-1.1 |