CVE-2026-47262: containerd Runtime DoS via Unbounded Group Parsing
Summary
CVE-2026-47262: containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd. Affects github.com/containerd/containerd versions >= 1.7.0, < 1.7.33. Fixed in 1.7.33. How to fix ↓
Also tracked for
The same CVE-2026-47262 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an industry-standard core container runtime that manages the complete container lifecycle, including image transfer, storage, and execution. It is widely used in cloud-native environments and is integral to many container orchestration platforms. The package is designed for high performance and scalability, but it is susceptible to vulnerabilities that can lead to denial of service (DoS) attacks, particularly through improper handling of image data.
Vulnerability Detail
The vulnerability identified as CVE-2026-47262 in containerd arises from unbounded group parsing when processing container images. This flaw can be exploited by an attacker to trigger a denial of service condition, causing the container runtime to become unresponsive. The issue originates from insufficient validation of input data, leading to excessive resource consumption during the parsing process. If exploited, this vulnerability can severely impact the availability of services relying on containerd, making it critical for users to address it promptly.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.33
This is the first release that contains the fix.
go get github.com/containerd/containerd@v1.7.33Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the resources allocated to the container runtime or implement network policies to restrict access to potentially malicious image sources until the package is updated.
Conclusion
CVE-2026-47262 is a critical vulnerability in the containerd package that can lead to denial of service through unbounded group parsing. Users are strongly encouraged to update to the latest patched versions to ensure the security and availability of their containerized applications.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
CVE-2026-47262 is a vulnerability in the containerd package that can lead to denial of service due to unbounded group parsing when processing container images.
Exploitation of this vulnerability can cause the container runtime to become unresponsive, impacting the availability of applications that rely on containerd.
Versions of containerd prior to 1.7.33 and 2.0.10, 2.1.9, 2.2.5, or 2.3.2 for the v2 package are affected by this vulnerability.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Gopkg.lock file without needing to sign up.
If an immediate update is not possible, consider implementing resource limits or network policies to mitigate potential exploitation of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
