# CVE-2026-95838: containerd layer unpack denial of service via opaque whiteouts

Source: https://junglewise.ai/threats/cve-2026-95838-containerd-unpack-dos-via-repeated-opaque-whiteouts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-95838 · Severity: medium · CVSS 4 · Published 2026-10-12

containerd is a container runtime that pulls and unpacks container images. A maliciously crafted image with specific file configurations can cause the unpack operation to take excessive time and CPU, delaying container startup and potentially blocking other image pulls in systems like Kubernetes that enforce concurrency limits.

Technologies: [Containerd](https://junglewise.ai/threats/technologies/containerd), [github.com/containerd/containerd (Go)](https://junglewise.ai/threats/technologies/github-com-containerd-containerd), [github.com/containerd/containerd/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-containerd-containerd-v2). Vendors: [Containerd](https://junglewise.ai/threats/vendors/containerd), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-95838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95838 being exploited in the wild.

**How severe is CVE-2026-95838?** Medium severity, with a CVSS score of 4, published 12 October 2026.

**Which products and versions are affected?** Containerd before 1.7.35, 2.0.12, 2.2.8, 2.3.5; github.com/containerd/containerd (Go) < 1.7.35, SEMVER:introduced=0,fixed=1.7.35; github.com/containerd/containerd/v2 (Go) < 2.0.12, SEMVER:introduced=0,fixed=2.0.12, SEMVER:introduced=0,fixed=2.0.12,introduced=2.2.0,fixed=2.2.8,introduced=2.3.0,fixed=2.3.5.

**Is there a fix for CVE-2026-95838?** Yes. github.com/containerd/containerd (Go): upgrade to 1.7.35 or later; github.com/containerd/containerd/v2 (Go): upgrade to 2.0.12, 2.3.5 or later. Until then: There are no known workarounds. Users should only pull and import trusted images from known registries until patching is applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-95838 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95838?** Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/containerd/containerd (Go): upgrade to 1.7.35 or later

  ```sh
  go get github.com/containerd/containerd@v1.7.35
  ```

- github.com/containerd/containerd/v2 (Go): upgrade to 2.0.12, 2.3.5 or later

  ```sh
  go get github.com/containerd/containerd/v2@v2.3.5
  ```


There are no known workarounds. Users should only pull and import trusted images from known registries until patching is applied.

## Technical details

The vulnerability exists in containerd's layer unpack handler, which exhibits superlinear time complexity when processing certain image layers containing specific file configurations (opaque whiteouts). This causes repeated directory traversals during unpacking. An attacker can craft a malicious image that, when pulled or imported, triggers this condition and degrades system performance without requiring authentication or network access beyond image pull.

## Affected products

- containerd containerd before 1.7.35, 2.0.12, 2.2.8, 2.3.5

## Identifiers

- CVE-2026-95838
- GHSA-rp3h-jf77-q9p4
- GO-2026-6796

## Timeline

- 2026-10-15: disclosed

## Related threats

- [containerd CRI plugin checkpoint restore privilege bypass](https://junglewise.ai/threats/cve-2026-95837-containerd-cri-plugin-checkpoint-restore-bypasses-destination)
- [Containerd image-pull denial of service via OCI index graph amplification](https://junglewise.ai/threats/cve-2026-53493-containerd-image-pull-denial-of-service-via-oci-index-graph)
- [containerd CRI ExecSync goroutine leak denial of service](https://junglewise.ai/threats/cve-2026-53495-containerd-cri-execsync-goroutine-leak-denial-of-service)
- [containerd CRI security context bypass in checkpoint restore](https://junglewise.ai/threats/containerd-cri-security-context-bypass-in-checkpoint-restore-d7cf36e0)
- [containerd CDI annotation smuggling during CRI checkpoint restore](https://junglewise.ai/threats/cve-2026-53492-containerd-cdi-annotation-smuggling-during-cri-checkpoint-restore)