The version of runc installed on the remote host is prior to 1.3.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-082 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the runc package has been released.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:20957 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
      * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)
      * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20072-1 advisory.

    - Update to runc v1.3.3:
      * CVE-2025-31133, CVE-2025-52565, CVE-2025-52881: Fixed container breakouts by bypassing         runc's restrictions for writing to arbitrary /proc files (bsc#1252232)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:21232 advisory.

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:0701 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.17.47. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2026:0715

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race     conditions (CVE-2025-31133)
    * runc: container escape with malicious config due to /dev/console mount     and related races (CVE-2025-52565)
    * runc: opencontainers/selinux: container escape and denial of service due     to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    All OpenShift Container Platform 4.17 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift CLI (oc)     or web console. Instructions for upgrading a cluster are available at     https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-     single/updating_clusters/index#updating-cluster-cli.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20103-1 advisory.

    - CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: container breakouts by bypassing runc's restrictions for     writing to arbitrary /proc files (bsc#1252376).
    - CVE-2025-9566: kube play command may overwrite host files (bsc#1249154).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs     files through the use of a racing container with shared mounts (we have also verified this attack is     possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering     parallel execution of containers with custom shared mounts configured). This redirect could be through     symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the     mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused     runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in     versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions     1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform     sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a     real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack:  an     arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape,     or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and     1.4.0-rc.3.(CVE-2025-31133)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
274657	Amazon Linux 2 : runc, --advisory ALAS2ECS-2025-082 (ALASECS-2025-082)	Nessus	Amazon Linux Local Security Checks	2025/11/11	2026/1/21	high
275323	Photon OS 5.0: Runc PHSA-2025-5.0-0676	Nessus	PhotonOS Local Security Checks	2025/11/13	2025/12/5	high
275822	AlmaLinux 9 : runc (ALSA-2025:20957)	Nessus	Alma Linux Local Security Checks	2025/11/19	2026/3/12	high
276601	openSUSE 16 Security Update : runc (openSUSE-SU-2025-20072-1)	Nessus	SuSE Local Security Checks	2025/11/24	2026/3/6	high
277168	RockyLinux 8 : container-tools:rhel8 (RLSA-2025:21232)	Nessus	Rocky Linux Local Security Checks	2025/12/3	2025/12/4	high
295328	RHEL 9 : OpenShift Container Platform 4.17.47 (RHSA-2026:0701)	Nessus	Red Hat Local Security Checks	2026/1/22	2026/1/22	high
296440	SUSE SLES16 Security Update : podman (SUSE-SU-2026:20103-1)	Nessus	SuSE Local Security Checks	2026/1/24	2026/4/30	high
297593	EulerOS 2.0 SP13 : docker-runc (EulerOS-SA-2026-1208)	Nessus	Huawei Local Security Checks	2026/2/2	2026/2/2	high

检测

插件搜索

high

high

high

high

high

high

high

high