It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1897 advisory.

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574 (CVE-2026-50195)

    Arbitrary host command execution through unvalidated image config labels propagated to containers

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp (CVE-2026-53488)

    Arbitrary file read on host via symlinked container log paths during checkpoint restore

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 (CVE-2026-53489)

    Device and host mount injection via CDI annotations in checkpoint metadata (requires CDI enabled on node)

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc (CVE-2026-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-133 advisory.

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574 (CVE-2026-50195)

    Arbitrary host command execution through unvalidated image config labels propagated to containers

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp (CVE-2026-53488)

    Arbitrary file read on host via symlinked container log paths during checkpoint restore

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 (CVE-2026-53489)

    Device and host mount injection via CDI annotations in checkpoint metadata (requires CDI enabled on node)

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc (CVE-2026-53492)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21213-1 advisory.

    This update for containerd fixes the following issues

    Update to 1.7.33:

    - CVE-2024-25621: overly broad default permission vulnerability (bsc#1253126).
    - CVE-2025-64329: goroutine leaks can lead to memory exhaustion on the host (bsc#1253132).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260296).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265794).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262948).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262266).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266640).
    - CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268355).
    - CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
    - CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation     (bsc#1268430).

    Changes for containerd:

     * https://github.com/containerd/containerd/releases/tag/v1.7.33
     * https://github.com/containerd/containerd/releases/tag/v1.7.32
     * https://github.com/containerd/containerd/releases/tag/v1.7.31
     * https://github.com/containerd/containerd/releases/tag/v1.7.30
     * https://github.com/containerd/containerd/releases/tag/v1.7.29
     * https://github.com/containerd/containerd/releases/tag/v1.7.28

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Containerd on the remote host is 1.7.x prior to 1.7.33, 2.0.x prior to 2.0.10, 2.1.x prior to 2.1.9, 2.2.x prior to 2.2.5, or 2.3.x prior to 2.3.2. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition.
    When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of     the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the     Docker Engine or Kubernetes control-plane components. (CVE-2026-47262)

  - A bug was found in containerd where the CRI plugin propagates labels from an image config (LABEL instruction in     Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via     a plugin that consumes container labels for some operations. (CVE-2026-53488)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8472-1 advisory.

    It was discovered that containerd incorrectly handled HTTP/2 SETTINGS frames. A remote attacker could     possibly use this issue to cause containerd to enter an infinite loop, resulting in a denial of service.
    (CVE-2026-33814)

    Jakub Ciolek and Kyle Elliott discovered that containerd incorrectly handled group parsing when creating     containers from images. An attacker could possibly use this issue to cause containerd to consume excessive     memory, resulting in a denial of service. (CVE-2026-47262)

    Henry Beberman and Robert Prast discovered that containerd incorrectly validated image references when     importing container checkpoints. An attacker could possibly use this issue to poison the local image cache     and execute arbitrary code in other pods. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS,     Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-50195)

    Robert Prast discovered that containerd incorrectly propagated labels from image configurations to     containers. An attacker could possibly use this issue to execute arbitrary code on the host.
    (CVE-2026-53488)

    Yuming Zhang, Song Li, Sangwon Ryu, Henry Beberman, Robert Prast, Kyle Elliott and Zhenchen Wang     discovered that containerd incorrectly validated symlinked paths when restoring container checkpoints. An     attacker could possibly use this issue to read arbitrary files on the host, resulting in information     disclosure. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10 and Ubuntu 26.04     LTS. (CVE-2026-53489)

    Robert Prast discovered that containerd incorrectly trusted device interface annotations when restoring     container checkpoints. An attacker could possibly use this issue to bypass resource allocation     restrictions and inject devices or host mounts into a container. This issue only affected Ubuntu 22.04     LTS, Ubuntu 24.04 LTS, Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-53492)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the containerd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2,     contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS)     condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of     Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can     disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been     fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.(CVE-2026-47262)

    containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and     2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a     container without validation. This may result in executing an arbitrary command on the host, via a plugin     that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2,     2.2.5, 2.1.9, and 2.0.10.(CVE-2026-53488)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has containerd packages installed that are affected by multiple vulnerabilities:

  - containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and     2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a     container without validation. This may result in executing an arbitrary command on the host, via a plugin     that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2,     2.2.5, 2.1.9, and 2.0.10. (CVE-2026-53488)

  - containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6,     2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach     implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in     versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission     controller to control accesses to pods/attach resources. (CVE-2025-64329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
321991	Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1897)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/3	critical
322038	Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-133 (ALASDOCKER-2026-133)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/7/3	critical
325038	openSUSE 16 Security Update : containerd (openSUSE-SU-2026:21213-1)	Nessus	SuSE Local Security Checks	2026/7/3	2026/7/3	critical
322407	Containerd 1.7.x < 1.7.33 / 2.0.x < 2.0.10 / 2.1.x < 2.1.9 / 2.2.x < 2.2.5 / 2.3.x < 2.3.2 Multiple Vulnerabilities	Nessus	Misc.	2026/6/24	2026/7/9	critical
322949	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : containerd vulnerabilities (USN-8472-1)	Nessus	Ubuntu Local Security Checks	2026/6/26	2026/7/8	critical
364071	EulerOS 2.0 SP15 : containerd (EulerOS-SA-2026-3902)	Nessus	Huawei Local Security Checks	2026/10/8	2026/10/8	critical
343597	NewStart CGSL MAIN 7.02 : containerd Multiple Vulnerabilities (NS-SA-2026-0097)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/8	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical