CVE-2026-95838

Name of the Vulnerable Software and Affected Versions containerd versions prior to 1.7.35 containerd versions prior to 2.0.12 containerd versions prior to 2.2.8 containerd versions prior to 2.3.5

Description The layer unpack handler in containerd contains a flaw where processing certain opaque whiteout configurations—files used to signal that all files in a directory should be removed—causes superlinear time complexity. A malicious image layer can trigger repeated directory traversals during the unpack operation. This can lead to high CPU consumption, delayed container startup, and reduced image-pull concurrency for unrelated deployments.

Recommendations Update to version 1.7.35 Update to version 2.0.12 Update to version 2.2.8 Update to version 2.3.5