25 entries matching containerd — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | HIGH | 7.5 | 50%ile | Microsoft | 2026-10-13 |
| CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http | HIGH | 7.5 | 37%ile | Microsoft | 2026-10-13 |
| CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http | HIGH | 7.5 | 49%ile | Microsoft | 2026-10-13 |
| CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | HIGH | 7.5 | 42%ile | Microsoft | 2026-10-13 |
| CVE-2026-61801 | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files | MEDIUM | 5.5 | 2%ile | Microsoft | 2026-10-13 |
| CVE-2026-95838 | containerd: Unpack DoS via repeated opaque whiteouts | UNKNOWN | — | 13%ile | Microsoft | 2026-10-13 |
| CVE-2026-84304 | gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation | HIGH | 7.5 | 49%ile | Microsoft | 2026-09-08 |
| CVE-2026-53493 | Containerd has image-pull DoS via crafted OCI index graph amplification | UNKNOWN | — | 29%ile | Microsoft | 2026-09-08 |
| CVE-2026-53495 | containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service | UNKNOWN | — | 5%ile | Microsoft | 2026-09-08 |
| CVE-2026-81870 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | UNKNOWN | — | 18%ile | Microsoft | 2026-09-08 |
| CVE-2026-84445 | gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers | UNKNOWN | — | 51%ile | Microsoft | 2026-09-08 |
| CVE-2026-56852 | Infinite loop on invalid input in golang.org/x/text | HIGH | 7.5 | 41%ile | Microsoft | 2026-07-14 |
| CVE-2026-10722 | cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow | LOW | 3.3 | 7%ile | Microsoft | 2026-06-09 |
| CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | CRITICAL | 10.0 | 79%ile | Microsoft | 2026-05-12 |
| CVE-2026-33814 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net | HIGH | 7.5 | 58%ile | Microsoft | 2026-05-12 |
| CVE-2026-25680 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html | MEDIUM | 6.5 | 26%ile | Microsoft | 2026-05-12 |
| CVE-2026-25681 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html | MEDIUM | 6.1 | 13%ile | Microsoft | 2026-05-12 |
| CVE-2026-27136 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html | MEDIUM | 6.1 | 13%ile | Microsoft | 2026-05-12 |
| CVE-2026-42502 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html | MEDIUM | 6.1 | 13%ile | Microsoft | 2026-05-12 |
| CVE-2026-42506 | Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html | MEDIUM | 6.1 | 15%ile | Microsoft | 2026-05-12 |
| CVE-2026-39824 | Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows | LOW | 3.3 | 2%ile | Microsoft | 2026-05-12 |
| CVE-2024-25621 | containerd affected by a local privilege escalation via wide permissions on CRI directory | HIGH | 7.3 | 6%ile | Microsoft | 2025-11-11 |
| CVE-2025-64329 | containerd CRI server: Host memory exhaustion through Attach goroutine leak | UNKNOWN | — | 6%ile | Microsoft | 2025-11-11 |
| CVE-2025-47291 | containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. | HIGH | 7.5 | 22%ile | Microsoft | 2025-05-13 |
| CVE-2025-22872 | Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net | MEDIUM | 6.5 | 46%ile | Microsoft | 2025-04-08 |