## containerd: Unpack DoS via repeated opaque whiteouts

- 種別: advisory
- 重大度: medium
- 関連技術: go, github, containerd
- CVE: CVE-2026-95838
- 公開日時: 2026-10-15T20:22:05.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-rp3h-jf77-q9p4)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-rp3h-jf77-q9p4

影響: go:github.com/containerd/containerd/v2 < 2.0.12 → 2.0.12, go:github.com/containerd/containerd < 1.7.35 → 1.7.35, go:github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.8 → 2.2.8, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.5 → 2.3.5
Impact A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or importing a maliciously crafted image can result in increased unpack times and a moderate increase in CPU usage. This delays container startup, even if the compressed image layers are small. Additionally, in…