The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21213-1 advisory.

    This update for containerd fixes the following issues

    Update to 1.7.33:

    - CVE-2024-25621: overly broad default permission vulnerability (bsc#1253126).
    - CVE-2025-64329: goroutine leaks can lead to memory exhaustion on the host (bsc#1253132).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260296).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265794).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262948).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262266).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266640).
    - CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268355).
    - CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
    - CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation     (bsc#1268430).

    Changes for containerd:

     * https://github.com/containerd/containerd/releases/tag/v1.7.33
     * https://github.com/containerd/containerd/releases/tag/v1.7.32
     * https://github.com/containerd/containerd/releases/tag/v1.7.31
     * https://github.com/containerd/containerd/releases/tag/v1.7.30
     * https://github.com/containerd/containerd/releases/tag/v1.7.29
     * https://github.com/containerd/containerd/releases/tag/v1.7.28

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1897 advisory.

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574 (CVE-2026-50195)

    Arbitrary host command execution through unvalidated image config labels propagated to containers

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp (CVE-2026-53488)

    Arbitrary file read on host via symlinked container log paths during checkpoint restore

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 (CVE-2026-53489)

    Device and host mount injection via CDI annotations in checkpoint metadata (requires CDI enabled on node)

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc (CVE-2026-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-133 advisory.

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574 (CVE-2026-50195)

    Arbitrary host command execution through unvalidated image config labels propagated to containers

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp (CVE-2026-53488)

    Arbitrary file read on host via symlinked container log paths during checkpoint restore

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 (CVE-2026-53489)

    Device and host mount injection via CDI annotations in checkpoint metadata (requires CDI enabled on node)

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc (CVE-2026-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dc2cbc1bc8 advisory.

    Automatic update for containerd-2.3.2-1.fc45.

    ##### **Changelog**

    ```
    * Fri Jun 26 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.2-1
    - Update to release v2.3.2
    - Resolves: rhbz#2464270
    - Resolves CVE-2026-34986: rhbz#2455637, rhbz#2455646
    - Resolves CVE-2026-35469: rhbz#2467593
    - Resolves CVE-2026-50195
    - Resolves CVE-2026-53488
    - Resolves CVE-2026-53492
    - Resolves CVE-2026-53489
    - Resolves CVE-2026-47262
    - Upstream fixes
    * Thu May 21 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.1-1
    - Update to release v2.3.1
    - Resolves: rhbz#2464270
    - Upstream feature enhancements and fixes
    - Resolves CVE-2026-34986: rhbz#2455637, rhbz#2455646
    - Resolves CVE-2026-35469: rhbz#2467593
    * Thu May 21 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.0-2
    - Build shim as static-pie
    - Build shim as static using static-pie to retain pie benefits and static       build. See https://github.com/containerd/containerd/discussions/13340#dis       cussioncomment-16883392 for additional information.
    * Fri May  1 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 2.3.0-1
    - Update to release v2.3.0
    - Refreshed spec file using go2rpm
    - Build now using gobuild macro for most binaries.
    - 'go build' is used for containerd-shim-runc-v2 to emulate makefile static       build

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-113 advisory.

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574 (CVE-2026-50195)

    Arbitrary host command execution through unvalidated image config labels propagated to containers

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp (CVE-2026-53488)

    Arbitrary file read on host via symlinked container log paths during checkpoint restore

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 (CVE-2026-53489)

    Device and host mount injection via CDI annotations in checkpoint metadata (requires CDI enabled on node)

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc (CVE-2026-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21072-1 advisory.

    This update for trivy fixes the following issues

    Update to version 0.71.2:

    - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to     DoS via infinite       loops, panics or resource consumption (bsc#1267268).
    - CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows     runAsNonRoot       evasion (bsc#1268356).
    - CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a     maliciously       crafted image (bsc#1268440).
    - CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's       configuration (bsc#1268399).
    - CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without     validation       (bsc#1268400).
    - CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating     a symlinked       path (bsc#1268404).
    - CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within     untrusted       checkpoint image metadata during container restoration (bsc#1268403).

    Changes for trivy:

     * release: v0.71.2 [release/v0.71] (#10871)
     * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
     * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
     * fix(oci): validate artifact filename
     * fix: forward ospkg detector options through ospkg.NewScanner
     * fix(vex): load VEX documents from within the repository        directory
     * fix: surface the original analysis error instead of context        cancellation
     * ci: expect GitHub App bot as backport PR author

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Containerd on the remote host is 1.7.x prior to 1.7.33, 2.0.x prior to 2.0.10, 2.1.x prior to 2.1.9, 2.2.x prior to 2.2.5, or 2.3.x prior to 2.3.2. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition.
    When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of     the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the     Docker Engine or Kubernetes control-plane components. (CVE-2026-47262)

  - A bug was found in containerd where the CRI plugin propagates labels from an image config (LABEL instruction in     Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via     a plugin that consumes container labels for some operations. (CVE-2026-53488)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3a690a88c2 advisory.

    Automatic update for moby-engine-29.6.2-1.fc45.

    ##### **Changelog**

    ```
    * Thu Jul 16 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 29.6.2-1
    - Update to release v29.6.2
    - Resolves: rhbz#2496437
    - Upstream security fixes
    - - GHSA-hw3h-2gp9-cxpv
    - - GHSA-qx3x-mv6r-52p6
    - - GHSA-32pv-7hq5-qhwq
    - - GHSA-g2h8-426c-7976
    - - GHSA-388v-wmr2-g2v2
    * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 29.6.1-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8472-1 advisory.

    It was discovered that containerd incorrectly handled HTTP/2 SETTINGS frames. A remote attacker could     possibly use this issue to cause containerd to enter an infinite loop, resulting in a denial of service.
    (CVE-2026-33814)

    Jakub Ciolek and Kyle Elliott discovered that containerd incorrectly handled group parsing when creating     containers from images. An attacker could possibly use this issue to cause containerd to consume excessive     memory, resulting in a denial of service. (CVE-2026-47262)

    Henry Beberman and Robert Prast discovered that containerd incorrectly validated image references when     importing container checkpoints. An attacker could possibly use this issue to poison the local image cache     and execute arbitrary code in other pods. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,     Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-50195)

    Robert Prast discovered that containerd incorrectly propagated labels from image configurations to     containers. An attacker could possibly use this issue to execute arbitrary code on the host.
    (CVE-2026-53488)

    Yuming Zhang, Song Li, Sangwon Ryu, Henry Beberman, Robert Prast, Kyle Elliott and Zhenchen Wang     discovered that containerd incorrectly validated symlinked paths when restoring container checkpoints. An     attacker could possibly use this issue to read arbitrary files on the host, resulting in information     disclosure. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10 and Ubuntu 26.04     LTS. (CVE-2026-53489)

    Robert Prast discovered that containerd incorrectly trusted device interface annotations when restoring     container checkpoints. An attacker could possibly use this issue to bypass resource allocation     restrictions and inject devices or host mounts into a container. This issue only affected Ubuntu 22.04     LTS, Ubuntu 24.04 LTS, Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-53492)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c37317fdde advisory.

    Automatic update for docker-buildx-0.36.0-1.fc45.

    ##### **Changelog**

    ```
    * Wed Jul 29 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 0.36.0-1
    - Update to release v0.36.0
    - Resolves: rhbz#2506339
    - Upstream new features and fixes
    - Resolves CVE-2026-53492 - rhbz#2496553
    - Resolves CVE-2026-47262 - rhbz#2496436

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
325038	openSUSE 16 Security Update : containerd (openSUSE-SU-2026:21213-1)	Nessus	SuSE Local Security Checks	2026/7/3	2026/7/3	critical
321991	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1897)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/3	critical
322038	Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-133 (ALASDOCKER-2026-133)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/3	critical
323660	Fedora 45 : containerd (2026-dc2cbc1bc8)	Nessus	Fedora Local Security Checks	2026/6/29	2026/7/7	critical
323720	Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-113 (ALASNITRO-ENCLAVES-2026-113)	Nessus	Amazon Linux Local Security Checks	2026/6/30	2026/7/7	critical
324052	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21072-1)	Nessus	SuSE Local Security Checks	2026/7/1	2026/7/3	critical
322407	Containerd 1.7.x < 1.7.33 / 2.0.x < 2.0.10 / 2.1.x < 2.1.9 / 2.2.x < 2.2.5 / 2.3.x < 2.3.2 Multiple Vulnerabilities	Nessus	Misc.	2026/6/24	2026/7/9	critical
327480	Fedora 45 : moby-engine (2026-3a690a88c2)	Nessus	Fedora Local Security Checks	2026/7/16	2026/7/16	medium
322949	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : containerd vulnerabilities (USN-8472-1)	Nessus	Ubuntu Local Security Checks	2026/6/26	2026/7/8	critical
330763	Fedora 45 : docker-buildx (2026-c37317fdde)	Nessus	Fedora Local Security Checks	2026/7/29	2026/7/29	high

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

medium

critical

high