Skip to main content

containerd CVE-2026-47262

| EUVDEUVD-2026-41106 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-06-19 GHSA-jpcc-p29g-p8mq
Docker Kubernetes Denial Of Service Containerd Red Hat
5.3
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.4 HIGH

Malicious image is hosted remotely (AV:N), no authentication needed to publish it (PR:N), an operator must run it (UI:R), and impact propagates to containerd/Kubernetes beyond the container (S:C, A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
Jul 01, 2026 - 19:22 NVD
5.3 (MEDIUM)
Analysis Generated
Jun 19, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 3

News 4 New Kubernetes Vulnerabilities - 3 Critical, 1 High Severity Jun 20, 2026 News 6 New Docker Vulnerabilities - 3 Critical, 3 High Severity Jun 20, 2026 News 6 New Docker Vulnerabilities - 3 Critical, 3 High Severity Jun 19, 2026

AnalysisAI

Memory exhaustion via maliciously crafted container image in containerd causes an OOM kill of the containerd process, rendering the container runtime API unavailable and disrupting orchestration layers including Docker Engine and Kubernetes control-plane components. CVE-2026-47262 is rated Moderate by the containerd project - lower than the four co-patched Critical/High CVEs - and is fixed across the full active supported release tree in versions 2.3.2, 2.2.5, 2.1.9, 2.0.10, and 1.7.33. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

The vulnerability resides in containerd's image processing and container creation pipeline. When containerd parses a specially crafted image during container instantiation, it fails to bound or throttle memory allocation, leading to unbounded growth that exhausts host memory and triggers the Linux OOM killer to terminate the containerd process. Containerd is the foundational container runtime daemon underpinning both Docker Engine (via dockerd) and Kubernetes (via the CRI plugin); its termination immediately halts all container lifecycle operations - create, start, stop, delete - until the daemon is restarted. No CWE is formally assigned in the source advisory data, but the root cause is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling). No CPE strings were included in the available intelligence; the advisory explicitly covers containerd releases spanning the 1.7.x, 2.0.x, 2.1.x, 2.2.x, and 2.3.x branches.

RemediationAI

Upgrade containerd to the patched release corresponding to your deployed branch: 1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2 - all available at https://github.com/containerd/containerd/releases. If an immediate upgrade is not possible, enforce an image allowlist via Kubernetes admission controllers such as OPA/Gatekeeper or Kyverno to restrict which registries and images nodes are permitted to pull from, reducing the attack surface to verified, trusted content only. Enabling image signing verification (Sigstore/Cosign or Notary) provides an additional barrier against introduction of malicious images. Configuring systemd with Restart=on-failure and RestartSec for the containerd service reduces downtime if an OOM event occurs, though it does not prevent exploitation. Tightening pod-creation RBAC to restrict which principals can introduce new images further limits the pool of potential attackers in shared cluster environments.

More in Docker

View all
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2019-5736 HIGH POC
8.6 Feb 11

runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
CVE-2023-32077 HIGH POC
7.5 Aug 24

Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2023-5815 HIGH POC
8.1 Nov 22

The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
CVE-2026-66384 MEDIUM POC
5.3 Aug 12

Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
CVE-2014-9357 CRITICAL
10.0 Dec 16

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
CVE-2026-52806 CRITICAL POC
9.9 Jun 23

Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
CVE-2026-56274 HIGH POC
8.7 Jun 23

Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
CVE-2026-34156 CRITICAL POC
9.9 Mar 30

Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
CVE-2019-15752 HIGH POC
7.8 Aug 28

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
CVE-2025-34221 CRITICAL POC
10.0 Sep 29

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.2.169 and Application prior to version 2

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Package Hub 15 SP7 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected

Share

CVE-2026-47262 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy