containerd: Unpack DoS via repeated opaque whiteouts

影響: go:github.com/containerd/containerd/v2 < 2.0.12 → 2.0.12, go:github.com/containerd/containerd < 1.7.35 → 1.7.35, go:github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.8 → 2.2.8, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.5 → 2.3.5

A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or importing a maliciously crafted image can result in increased unpack times and a moderate increase in CPU usage. This delays container startup, even if the compressed image layers are small. Additionally, in…

GitHub Advisory Databaseで読む

2026/10/16 05:22、GitHub Advisory Databaseが「containerd: Unpack DoS via repeated opaque whiteouts」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Go、GitHub、containerd。CVE: CVE-2026-95838。