# github.com/opencontainers/runc (Go) vulnerabilities 16 known vulnerabilities (5 high, 4 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.5.2 (Sep 24, 2026): no advisory affects it - Newest unaffected release: v1.5.2 (Sep 24, 2026), the latest release - Releases: 84 since v0.0.1 (Jul 16, 2015) - Registry: https://pkg.go.dev/github.com/opencontainers/runc - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-41579: v0.0.1 to v1.3.5 (v1.3.6 is outside it); v1.4.0 to v1.4.2 (v1.4.3 is outside it); v1.5.0-rc.1 to v1.5.0-rc.2 (v1.5.0-rc.3 is outside it) - CVE-2025-52881: v0.0.1 to v1.2.7 (v1.2.8 is outside it); v1.3.0-rc.1 to v1.3.2 (v1.3.3 is outside it); v1.4.0-rc.1 to v1.4.0-rc.2 (v1.4.0-rc.3 is outside it) - CVE-2025-52565: v1.0.0-rc3 to v1.2.7 (v1.2.8 is outside it); v1.3.0-rc.1 to v1.3.2 (v1.3.3 is outside it); v1.4.0-rc.1 to v1.4.0-rc.2 (v1.4.0-rc.3 is outside it) - CVE-2025-31133: v0.0.1 to v1.2.7 (v1.2.8 is outside it); v1.3.0-rc.1 to v1.3.2 (v1.3.3 is outside it); v1.4.0-rc.1 to v1.4.0-rc.2 (v1.4.0-rc.3 is outside it) - CVE-2024-45310: v0.0.1 to v1.1.13 (v1.1.14 is outside it); v1.2.0-rc.1 to v1.2.0-rc.2 (v1.2.0-rc.3 is outside it) - CVE-2024-21626: v1.0.0-rc93 to v1.1.11 (v1.1.12 is outside it) - CVE-2023-25809: v0.0.1 to v1.1.4 (v1.1.5 is outside it) - CVE-2023-28642: v0.0.1 to v1.1.4 (v1.1.5 is outside it) - CVE-2023-27561: v1.0.0-rc95 to v1.1.4 (v1.1.5 is outside it) - CVE-2022-29162: v0.0.1 to v1.1.1 (v1.1.2 is outside it) - CVE-2021-43784: v0.0.1 to v1.1.0-rc.1 (v1.1.0 is outside it) - CVE-2021-30465: v0.0.1 to v1.0.0-rc94 (v1.0.0-rc95 is outside it) - CVE-2019-19921: v0.0.1 to v1.0.0-rc9 (v1.0.0-rc90 is outside it) - CVE-2019-16884: v0.0.1 to v1.0.0-rc8 (v1.0.0-rc9 is outside it) - CVE-2016-9962: v0.0.1 to v1.0.0-rc2 (v1.0.0-rc3 is outside it) - CVE-2016-3697: v0.0.1 to v0.0.9 (v0.1.0 is outside it) ## Advisories (16) ### [CVE-2026-41579](https://cve.now/CVE-2026-41579): runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations - Severity: Low 3.3 - Published: Jul 1, 2026 - Affected: fixed in 1.3.6; from 1.4.0, fixed in 1.4.3; from 1.5.0-rc.1, fixed in 1.5.0-rc.3; fixed in 1.3.6; from 1.4.0, fixed in 1.4.3; from 1.5.0-rc.1, fixed in 1.5.0-rc.3. - Fixed in v1.3.6 (released Jun 13, 2026, 18 days before disclosure), v1.4.3 (released Jun 13, 2026, 18 days before disclosure) and v1.5.0-rc.3 (released Jun 13, 2026, 18 days before disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2025-52881](https://cve.now/CVE-2025-52881): runc: LSM labels can be bypassed with malicious config using dummy procfs files - Severity: High 7.3 - Published: Nov 6, 2025 - Affected: fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3; fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3. - Fixed in v1.2.8 (released Nov 5, 2025, 1 day before disclosure), v1.3.3 (released Nov 5, 2025, 1 day before disclosure) and v1.4.0-rc.3 (released Nov 5, 2025, 1 day before disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2025-52565](https://cve.now/CVE-2025-52565): container escape due to /dev/console mount and related races - Severity: High 8.4 - Published: Nov 6, 2025 - Affected: from 1.0.0-rc3, fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3; from 1.0.0-rc3, fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3. - Fixed in v1.2.8 (released Nov 5, 2025, 1 day before disclosure), v1.3.3 (released Nov 5, 2025, 1 day before disclosure) and v1.4.0-rc.3 (released Nov 5, 2025, 1 day before disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2025-31133](https://cve.now/CVE-2025-31133): runc container escape via "masked path" abuse due to mount race conditions - Severity: High 7.3 - Published: Nov 6, 2025 - Affected: fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3; fixed in 1.2.8; from 1.3.0-rc.1, fixed in 1.3.3; from 1.4.0-rc.1, fixed in 1.4.0-rc.3. - Fixed in v1.2.8 (released Nov 5, 2025, 1 day before disclosure), v1.3.3 (released Nov 5, 2025, 1 day before disclosure) and v1.4.0-rc.3 (released Nov 5, 2025, 1 day before disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2024-45310](https://cve.now/CVE-2024-45310): runc can be confused to create empty files/directories on the host - Severity: Low 3.6 - Published: Sep 3, 2024 - Affected: fixed in 1.1.14; from 1.2.0-rc.1, fixed in 1.2.0-rc.3; fixed in 1.1.14; from 1.2.0-rc.1, fixed in 1.2.0-rc.3. - Fixed in v1.1.14 (released Sep 3, 2024, the day of disclosure) and v1.2.0-rc.3 (released Sep 3, 2024, the day of disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2024-21626](https://cve.now/CVE-2024-21626): runc container breakout through process.cwd trickery and leaked fds - Severity: High 8.6 - Published: Jan 31, 2024 - Affected: from 1.0.0-rc93, fixed in 1.1.12. - Fixed in v1.1.12 (released Jan 23, 2024, 8 days before disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2023-25809](https://cve.now/CVE-2023-25809): rootless: \`/sys/fs/cgroup\` is writable when cgroupns isn't unshared in runc - Severity: Medium 5.0 - Published: Mar 29, 2023 - Affected: fixed in 1.1.5. - Fixed in v1.1.5 (released Mar 29, 2023, the day of disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2023-28642](https://cve.now/CVE-2023-28642): AppArmor bypass with symlinked /proc in runc - Severity: Medium 6.1 - Published: Mar 29, 2023 - Affected: fixed in 1.1.5. - Fixed in v1.1.5 (released Mar 29, 2023, the day of disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2023-27561](https://cve.now/CVE-2023-27561): runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs\_linux.go. - Severity: High 7.0 - Published: Mar 3, 2023 - Affected: from 1.0.0-rc95, fixed in 1.1.5. - Fixed in v1.1.5 (released Mar 29, 2023, 26 days after disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2022-29162](https://cve.now/CVE-2022-29162): Incorrect Default Permissions in runc - Severity: Medium 5.9 - Published: May 17, 2022 - Affected: fixed in 1.1.2. - Fixed in v1.1.2 (released May 5, 2022, 12 days before disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2021-43784](https://cve.now/CVE-2021-43784): Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration - Severity: Medium 6.0 - Published: Dec 6, 2021 - Affected: from 1.0.1-0.20211012131345-9c444070ec7b, fixed in 1.1.0; fixed in 1.0.3. - Fixed in v1.1.0 (released Jan 17, 2022, 42 days after disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2021-30465](https://cve.now/CVE-2021-30465): runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. - Severity: Unrated - Published: May 27, 2021 - Affected: fixed in 1.0.0-rc95. - Fixed in v1.0.0-rc95 (released May 19, 2021, 8 days before disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2019-19921](https://cve.now/CVE-2019-19921): runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs\_linux.go. - Severity: Unrated - Published: Feb 12, 2020 - Affected: fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77. - Fixed in v1.0.0 (released Jun 17, 2021, 491 days after disclosure, the advisory names 1.0.0-rc9.0.20200122160610-2fc03cc11c77, which was never published). - The latest release, v1.5.2, is not affected. ### [CVE-2019-16884](https://cve.now/CVE-2019-16884): runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because… - Severity: Unrated - Published: Sep 25, 2019 - Affected: fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932. - Fixed in v1.0.0 (released Jun 17, 2021, 631 days after disclosure, the advisory names 1.0.0-rc8.0.20190930145003-cad42f6e0932, which was never published). - The latest release, v1.5.2, is not affected. ### [CVE-2016-9962](https://cve.now/CVE-2016-9962): RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. - Severity: Unrated - Published: Jan 31, 2017 - Affected: fixed in 1.0.0-rc3. - Fixed in v1.0.0-rc3 (released Mar 21, 2017, 49 days after disclosure). - The latest release, v1.5.2, is not affected. ### [CVE-2016-3697](https://cve.now/CVE-2016-3697): libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username… - Severity: Unrated - Published: Jun 1, 2016 - Affected: fixed in 0.1.0. - Fixed in v0.1.0 (released Apr 12, 2016, 50 days before disclosure). - The latest release, v1.5.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/opencontainers/runc Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.