CVE-2026-47262: containerd Denial of Service via unbounded group parsing in images

CVE-2026-47262 · Severity: medium · CVSS 4 · Published 2026-07-01

containerd is a core component used by Docker and Kubernetes to run and manage containers. A vulnerability allows a specially crafted container image to exhaust the system's memory when it is loaded. This can crash the container runtime, causing a service outage for all other containers on the host and disrupting management tools like Kubernetes.

Technologies: Containerd, github.com/containerd/containerd (Go), github.com/containerd/containerd/v2 (Go). Vendors: Containerd, Go.

Quick answers

Is CVE-2026-47262 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47262 being exploited in the wild.
How severe is CVE-2026-47262?
Medium severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?
Containerd >= 1.7.0, < 1.7.33; >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2; github.com/containerd/containerd (Go) SEMVER:introduced=1.7.0,fixed=1.7.33; github.com/containerd/containerd/v2 (Go) SEMVER:introduced=2.0.0,fixed=2.0.10, SEMVER:introduced=2.0.0,fixed=2.0.10,introduced=2.1.0,fixed=2.1.9,introduced=2.2.0,fixed=2.2.5,introduced=2.3.0,fixed=2.3.2.
Is there a fix for CVE-2026-47262?
Yes. github.com/containerd/containerd (Go): upgrade to 1.7.33 or later; github.com/containerd/containerd/v2 (Go): upgrade to 2.0.10, 2.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47262 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47262?
Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/containerd/containerd (Go): upgrade to 1.7.33 or later
    go get github.com/containerd/containerd@v1.7.33
  • github.com/containerd/containerd/v2 (Go): upgrade to 2.0.10, 2.3.2 or later
    go get github.com/containerd/containerd/v2@v2.3.2

Technical details

A vulnerability classified as Uncontrolled Resource Consumption (CWE-400) exists in containerd due to unbounded group parsing when processing container images. An attacker with the ability to provide or schedule a maliciously crafted image can trigger memory exhaustion during container creation. This leads to an Out Of Memory (OOM) kill of the containerd process, rendering the runtime API unavailable and impacting downstream clients like Docker Engine or Kubernetes. The issue is fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2. Exploitation requires the ability to import images or schedule pods (PR:L).

Affected products

  • containerd containerd >= 1.7.0, < 1.7.33; >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2

Identifiers

  • CVE-2026-47262
  • GHSA-jpcc-p29g-p8mq
  • GO-2026-5475

Timeline

  • 2026-06-18: advisory: GitHub advisory published by maintainers
  • 2026-07-01: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.