{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "1.7.35"
              },
              {
                "introduced": "2.0.0-beta.0"
              },
              {
                "fixed": "2.0.12"
              },
              {
                "introduced": "2.2.0"
              },
              {
                "fixed": "2.2.8"
              },
              {
                "introduced": "2.3.0"
              },
              {
                "fixed": "2.3.5"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "de55dfc0f184aa6ed19de4dc02a3a4bae3476c88"
            },
            {
              "introduced": "1c4457e00facac03ce1d75f7b6777a7a851e5c41"
            },
            {
              "introduced": "2976f38ccbfcda5ef1364d63d60b0a304e4bf94a"
            },
            {
              "fixed": "0fab6e1c57c38c945dd004bd1d560d1b0915822f"
            },
            {
              "fixed": "f8877dc22535f7c22699399c1dfe6160018792fa"
            },
            {
              "fixed": "941d3ed89ad60ad91cac377a16ecde23e2143083"
            },
            {
              "fixed": "1294c24a7da8e5a793ed378161673abe94118892"
            },
            {
              "fixed": "e6ca378dcfa610d06589a3ac96aa992de866e4f0"
            }
          ],
          "repo": "https://github.com/containerd/containerd",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-rp3h-jf77-q9p4"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-400",
      "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95838.json"
  },
  "details": "containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.",
  "id": "CVE-2026-95838",
  "modified": "2026-10-14T10:31:04.466959129Z",
  "published": "2026-10-12T19:53:24.599Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95838.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95838"
    },
    {
      "type": "FIX",
      "url": "https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "containerd: Unpack DoS via repeated opaque whiteouts"
}