containerd: Unpack DoS via repeated opaque whiteouts

影響: go:github.com/containerd/containerd/v2 < 2.0.12 → 2.0.12, go:github.com/containerd/containerd < 1.7.35 → 1.7.35, go:github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.8 → 2.2.8, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.5 → 2.3.5

A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or importing a maliciously crafted image can result in increased unpack times and a moderate increase in CPU usage. This delays container startup, even if the compressed image layers are small. Additionally, in…

在 GitHub Advisory Database 阅读

2026/10/16 05:22，GitHub Advisory Database 发布了“containerd: Unpack DoS via repeated opaque whiteouts”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub、containerd。CVE：CVE-2026-95838。