Ambiguous OCI manifest parsing in github.com/containerd/containerd

Description

References

• containerd/containerd security advisory · ADVISORY
• containerd/containerd commit 26c76a3 · FIX
• containerd/containerd commit db00065 · FIX
• containerd/containerd release v1.4.12 · WEB
• containerd/containerd release v1.5.8 · WEB
• opencontainers/distribution-spec security advisory · WEB
• opencontainers/image-spec security advisory · WEB

Altre vulnerabilità di github.com/containerd/containerd

• CVE-2026-95838MEDIO 4.6containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly trav…
• CVE-2026-95837ALTO 7.8containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vul…
• CVE-2026-53493MEDIO 6.9containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can for…
• CVE-2026-53495MEDIO 6.8containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled c…
• CVE-2026-53492CRITICO 9.6containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Contai…