Uncaught Exception in containerd - CVE-2026-95839
Published: October 14, 2026
Vulnerability identifier: #VU155696
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-95839
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an unrecovered panic in containerd's image manifest processing when pulling or importing an image through the transfer service whose child descriptor contains the io.containerd.manifest.subject annotation and a malformed digest. A remote attacker can supply an image manifest containing such a descriptor to cause a denial of service.
The transfer service includes default CRI PullImage requests. In Kubernetes environments, kubelet automatically retries failed image pulls with backoff for pods referencing an untrusted image.
Affected software
containerd
How to mitigate CVE-2026-95839
Install security update from vendor's website.
containerd - addressed in versions 2.2.10, 2.3.7, 2.4.2