Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/opencontainers/runc

16 known vulnerabilities (5 high, 4 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
v1.5.2 (Sep 24, 2026): no advisory affects it
Newest unaffected release
v1.5.2 (Sep 24, 2026), the latest release
Advisories
16 · 5 high, 4 medium, 2 low
Releases
84 since v0.0.1 (Jul 16, 2015)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-41579
    Affects v0.0.1 to v1.3.5 (v1.3.6 is outside it); v1.4.0 to v1.4.2 (v1.4.3 is outside it); v1.5.0-rc.1 to v1.5.0-rc.2 (v1.5.0-rc.3 is outside it)
  • CVE-2025-52881
    Affects v0.0.1 to v1.2.7 (v1.2.8 is outside it); v1.3.0-rc.1 to v1.3.2 (v1.3.3 is outside it); v1.4.0-rc.1 to v1.4.0-rc.2 (v1.4.0-rc.3 is outside it)
  • CVE-2025-52565
    Affects v1.0.0-rc3 to v1.2.7 (v1.2.8 is outside it); v1.3.0-rc.1 to v1.3.2 (v1.3.3 is outside it); v1.4.0-rc.1 to v1.4.0-rc.2 (v1.4.0-rc.3 is outside it)
  • CVE-2025-31133
    Affects v0.0.1 to v1.2.7 (v1.2.8 is outside it); v1.3.0-rc.1 to v1.3.2 (v1.3.3 is outside it); v1.4.0-rc.1 to v1.4.0-rc.2 (v1.4.0-rc.3 is outside it)
  • CVE-2024-45310
    Affects v0.0.1 to v1.1.13 (v1.1.14 is outside it); v1.2.0-rc.1 to v1.2.0-rc.2 (v1.2.0-rc.3 is outside it)
  • CVE-2024-21626
    Affects v1.0.0-rc93 to v1.1.11 (v1.1.12 is outside it)
  • CVE-2023-25809
    Affects v0.0.1 to v1.1.4 (v1.1.5 is outside it)
  • CVE-2023-28642
    Affects v0.0.1 to v1.1.4 (v1.1.5 is outside it)
  • CVE-2023-27561
    Affects v1.0.0-rc95 to v1.1.4 (v1.1.5 is outside it)
  • CVE-2022-29162
    Affects v0.0.1 to v1.1.1 (v1.1.2 is outside it)
  • CVE-2021-43784
    Affects v0.0.1 to v1.1.0-rc.1 (v1.1.0 is outside it)
  • CVE-2021-30465
    Affects v0.0.1 to v1.0.0-rc94 (v1.0.0-rc95 is outside it)
Show all 16 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 16

  • runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

    Affected: fixed in 1.3.6; from 1.4.0, fixed in 1.4.3; from 1.5.0-rc.1, fixed in 1.5.0-rc.3; fixed in 1.3.6; from 1.4.0, fixed in 1.4.3; from 1.5.0-rc.1, fixed in 1.5.0-rc.3.

    Fixed in v1.3.6 (released Jun 13, 2026, 18 days before disclosure), v1.4.3 (released Jun 13, 2026, 18 days before disclosure) and v1.5.0-rc.3 (released Jun 13, 2026, 18 days before disclosure).

    The latest release, v1.5.2, is not affected.

  • runc: LSM labels can be bypassed with malicious config using dummy procfs files

    Affected: fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3; fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3.

    Fixed in v1.2.8 (released Nov 5, 2025, 1 day before disclosure), v1.3.3 (released Nov 5, 2025, 1 day before disclosure) and v1.4.0-rc.3 (released Nov 5, 2025, 1 day before disclosure).

    The latest release, v1.5.2, is not affected.

  • container escape due to /dev/console mount and related races

    Affected: from 1.0.0-rc3, fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3; from 1.0.0-rc3, fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3.

    Fixed in v1.2.8 (released Nov 5, 2025, 1 day before disclosure), v1.3.3 (released Nov 5, 2025, 1 day before disclosure) and v1.4.0-rc.3 (released Nov 5, 2025, 1 day before disclosure).

    The latest release, v1.5.2, is not affected.

  • runc container escape via "masked path" abuse due to mount race conditions

    Affected: fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3; fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3.

    Fixed in v1.2.8 (released Nov 5, 2025, 1 day before disclosure), v1.3.3 (released Nov 5, 2025, 1 day before disclosure) and v1.4.0-rc.3 (released Nov 5, 2025, 1 day before disclosure).

    The latest release, v1.5.2, is not affected.

  • runc can be confused to create empty files/directories on the host

    Affected: fixed in 1.1.14; from 1.2.0-rc.1, fixed in 1.2.0-rc.3; fixed in 1.1.14; from 1.2.0-rc.1, fixed in 1.2.0-rc.3.

    Fixed in v1.1.14 (released Sep 3, 2024, the day of disclosure) and v1.2.0-rc.3 (released Sep 3, 2024, the day of disclosure).

    The latest release, v1.5.2, is not affected.

  • runc container breakout through process.cwd trickery and leaked fds

    Affected: from 1.0.0-rc93, fixed in 1.1.12.

    Fixed in v1.1.12 (released Jan 23, 2024, 8 days before disclosure).

    The latest release, v1.5.2, is not affected.

  • CVE-2023-25809Medium 5.0

    rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

    Affected: fixed in 1.1.5.

    Fixed in v1.1.5 (released Mar 29, 2023, the day of disclosure).

    The latest release, v1.5.2, is not affected.

  • CVE-2023-28642Medium 6.1

    AppArmor bypass with symlinked /proc in runc

    Affected: fixed in 1.1.5.

    Fixed in v1.1.5 (released Mar 29, 2023, the day of disclosure).

    The latest release, v1.5.2, is not affected.

  • runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.

    Affected: from 1.0.0-rc95, fixed in 1.1.5.

    Fixed in v1.1.5 (released Mar 29, 2023, 26 days after disclosure).

    The latest release, v1.5.2, is not affected.

  • CVE-2022-29162Medium 5.9

    Incorrect Default Permissions in runc

    Affected: fixed in 1.1.2.

    Fixed in v1.1.2 (released May 5, 2022, 12 days before disclosure).

    The latest release, v1.5.2, is not affected.

  • CVE-2021-43784Medium 6.0

    Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration

    Affected: from 1.0.1-0.20211012131345-9c444070ec7b, fixed in 1.1.0; fixed in 1.0.3.

    Fixed in v1.1.0 (released Jan 17, 2022, 42 days after disclosure).

    The latest release, v1.5.2, is not affected.

  • runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal.

    Affected: fixed in 1.0.0-rc95.

    Fixed in v1.0.0-rc95 (released May 19, 2021, 8 days before disclosure).

    The latest release, v1.5.2, is not affected.

  • runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.

    Affected: fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77.

    Fixed in v1.0.0 (released Jun 17, 2021, 491 days after disclosure, the advisory names 1.0.0-rc9.0.20200122160610-2fc03cc11c77, which was never published).

    The latest release, v1.5.2, is not affected.

  • runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because…

    Affected: fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932.

    Fixed in v1.0.0 (released Jun 17, 2021, 631 days after disclosure, the advisory names 1.0.0-rc8.0.20190930145003-cad42f6e0932, which was never published).

    The latest release, v1.5.2, is not affected.

  • RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container.

    Affected: fixed in 1.0.0-rc3.

    Fixed in v1.0.0-rc3 (released Mar 21, 2017, 49 days after disclosure).

    The latest release, v1.5.2, is not affected.

  • libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username…

    Affected: fixed in 0.1.0.

    Fixed in v0.1.0 (released Apr 12, 2016, 50 days before disclosure).

    The latest release, v1.5.2, is not affected.