# cve.now: Containerd

The newest entries naming Containerd as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-47218](https://cve.now/CVE-2026-47218.md): runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox (CVSS 9.3)
- [CVE-2026-95838](https://cve.now/CVE-2026-95838.md): containerd: Unpack DoS via repeated opaque whiteouts (CVSS 4.6)
- [CVE-2026-95837](https://cve.now/CVE-2026-95837.md): containerd CRI plugin: Checkpoint restore bypasses destination security context (CVSS 7.8)
- [CVE-2026-107446](https://cve.now/CVE-2026-107446.md): containerd overlaybd through 1.0.18 has a do\_load\_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for (CVSS 6.8)
- [CVE-2026-53493](https://cve.now/CVE-2026-53493.md): Containerd has image-pull DoS via crafted OCI index graph amplification (CVSS 6.9)
- [CVE-2026-53495](https://cve.now/CVE-2026-53495.md): containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service (CVSS 6.8)
- [CVE-2026-53489](https://cve.now/CVE-2026-53489.md): containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore (CVSS 8.2)
- [CVE-2026-53492](https://cve.now/CVE-2026-53492.md): containerd CRI checkpoint restore CDI annotation smuggling (CVSS 8.4)
- [CVE-2026-50195](https://cve.now/CVE-2026-50195.md): containerd: CRI checkpoint import allows local image tag poisoning (CVSS 5.6)
- [CVE-2026-47262](https://cve.now/CVE-2026-47262.md): containerd image-triggered runtime DoS via unbounded group parsing (CVSS 5.3)
- [CVE-2026-46680](https://cve.now/CVE-2026-46680.md): containerd user ID handling bypass allows runAsNonRoot evasion (CVSS 7.3)
- [CVE-2026-53488](https://cve.now/CVE-2026-53488.md): containerd CRI plugin: — image-config \`LABEL\` flows to restart-monitor \`binary://\` logger: host-root command execution from an image pull (CVSS 9.4)
- [CVE-2025-64329](https://cve.now/CVE-2025-64329.md): containerd CRI server: Host memory exhaustion through Attach goroutine leak (CVSS 6.9)
- [CVE-2024-25621](https://cve.now/CVE-2024-25621.md): containerd affected by a local privilege escalation via wide permissions on CRI directory (CVSS 7.3)
- [CVE-2025-47291](https://cve.now/CVE-2025-47291.md): containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (CVSS 4.6)
- [CVE-2025-47290](https://cve.now/CVE-2025-47290.md): Containerd vulnerable to host filesystem access during image unpack (CVSS 7.6)
- [CVE-2024-40635](https://cve.now/CVE-2024-40635.md): containerd has an integer overflow in User ID handling (CVSS 4.6)
- [CVE-2023-25173](https://cve.now/CVE-2023-25173.md): containerd supplementary groups are not set up properly (CVSS 5.3)
- [CVE-2023-25153](https://cve.now/CVE-2023-25153.md): containerd OCI image importer memory exhaustion (CVSS 6.2)
- [CVE-2022-23471](https://cve.now/CVE-2022-23471.md): containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak (CVSS 5.7)
- [CVE-2022-31030](https://cve.now/CVE-2022-31030.md): containerd CRI plugin: Host memory exhaustion through ExecSync (CVSS 5.5)
- [CVE-2022-24778](https://cve.now/CVE-2022-24778.md): Incorrect Authorization in imgcrypt (CVSS 7.5)
- [CVE-2022-23648](https://cve.now/CVE-2022-23648.md): Insecure handling of image volumes in containerd CRI plugin (CVSS 7.5)
- [CVE-2021-43816](https://cve.now/CVE-2021-43816.md): Improper Preservation of Permissions in containerd (CVSS 8.0)
- [CVE-2021-41103](https://cve.now/CVE-2021-41103.md): Insufficiently restricted permissions on plugin directories (CVSS 5.9)
- [CVE-2021-32760](https://cve.now/CVE-2021-32760.md): Archive package allows chmod of file outside of unpack target directory (CVSS 5.0)
- [CVE-2021-21334](https://cve.now/CVE-2021-21334.md): environment variable leak (CVSS 6.3)
- [CVE-2020-15257](https://cve.now/CVE-2020-15257.md): containerd-shim API Exposed to Host Network Containers (CVSS 5.2)
- [CVE-2020-15157](https://cve.now/CVE-2020-15157.md): containerd can be coerced into leaking credentials during image pull (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/containerd
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.