CVE Explorer
CVE-2026-47262
containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This iss
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"containerd","vendor":"containerd","versions":[{"status":"affected","version":">= 1.7.0, < 1.7.33"},{"status":"affected","version":">= 2.0.0, < 2.0.10"},{"status":"affected","version":">= 2.1.0, < 2.1.9"},{"status":"affected","version":">= 2.2.0, < 2.2.5"},{"status":"affected","version":">= 2.3.0, < 2.3.2"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:9992c1488d42a7ce139f131035e988c03b8a0da760c78e906f8840e19e163a1d · sha256:92085ef62d082979… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:9992c1488d42a7ce139f131035e988c03b8a0da760c78e906f8840e19e163a1d · sha256:92085ef62d082979… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9992c1488d42a7ce139f131035e988c03b8a0da760c78e906f8840e19e163a1d · sha256:92085ef62d082979… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq","tags":["x_refsource_CONFIRM"],"url":"https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:9992c1488d42a7ce139f131035e988c03b8a0da760c78e906f8840e19e163a1d · sha256:92085ef62d082979… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.