Directory Traversal Vulnerability in Containerd by Docker

CVE-2026-95838

What is CVE-2026-95838?

Containerd, an open-source container runtime, is susceptible to a directory traversal attack due to its layer unpacking handler. Versions prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5 allow a malicious image layer to exploit the handling of opaque whiteout configurations. This results in excessive directory traversals that can lead to increased CPU consumption, delayed container startups, and degraded performance during image pulls for other unrelated deployments. These vulnerabilities have been addressed in the latest versions for improved security and efficiency.

References