VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/containerd/containerd/v2: vulnerability history, versions and safety

github.com/containerd/containerd/v2 is a package in the Go ecosystem. Vulert records 13 vulnerabilities for it across 120 releases, from Mar 2025 to Oct 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
13 vulnerabilities recorded H4 M7 U2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
8 in the last 12 months

Most recent disclosure 15 Oct 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/containerd/containerd/v2 vulnerabilities

Vulert verdict on github.com/containerd/containerd/v2 v2.4.2 i

Updated on 23 Oct 2026

Action needed: v2.4.2 has 3 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 78/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v2.4.2 — affected i
  • Vulnerabilities on record 13 over 1 year · 8 in the last year i
  • Latest disclosure 15 Oct 2026 i
  • Highest CVSS 8.4 i
  • With no published fix 0 i
  • Stars 21,435 i
  • OpenSSF scorecard 8/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/containerd/containerd/v2, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v2.4.1-0.20261021233101-57d315c6ec7c 21 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261020204746-2c2a63f43253 20 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261020203511-82d0ef957341 20 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.3-0.20261020145208-340a0d761004 20 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261020001930-5284371f059d 20 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261019051524-b1ab012ef66d 19 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261018055615-954541ee2d40 18 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261017223626-eea5fb4398d3 17 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261017010707-ae65337745cf 17 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261016214319-eea131263805 16 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261015214334-c787e39387ec 15 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261014145907-02771a9d6d3f 14 Oct 2026 M3 Apache-2.0 Yes Details →
v2.3.7 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.2.10 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.2 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.2-0.20261013222512-b7a25261e029 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.0.14 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261013202915-2467f228a02a 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261013024931-92f321c8da22 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.2-0.20261013010235-6a78f854af4b 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261013002947-8c451c9ce524 13 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261011201546-0a74f56c126a 11 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261010185722-b05f02e2a68d 10 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261007141808-3ea5bdbfbd9f 07 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.2-0.20261006215517-aec85b3d3281 06 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.2-0.20261006195227-098de667dd0b 06 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261006182228-e851c87063da 06 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261005170722-ebefff91ad5b 05 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261002222544-81af89b1d4b1 02 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.2-0.20261002205607-6b631559bd8f 02 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261002155735-250501a5dbb0 02 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20261001162006-eb4dbd872d92 01 Oct 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260930180834-df742f8d7ee7 30 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260930131941-fcb8ec69701d 30 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.2-0.20260928214237-7936ee5789f2 28 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260928210603-cf413d5d96ee 28 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260925234745-934434dde54b 25 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1 24 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260924232958-f2551031d727 24 Sep 2026 M3 Apache-2.0 Yes Details →
v2.2.9 24 Sep 2026 M3 Apache-2.0 Yes Details →
v2.3.6 24 Sep 2026 M3 Apache-2.0 Yes Details →
v2.0.13 24 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260924214456-82f33ce76db8 24 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260924004150-e210d8492d56 24 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260921192510-5152cb5d5325 21 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260919224948-b0a37b632b22 19 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260919194859-00d47249da09 19 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260917201555-00a8ed44477f 17 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260917153506-49d1f5388095 17 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260917003438-7a233f38947b 17 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.1-0.20260916205852-fe4ef048ad6d 16 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0 16 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-rc.0.0.20260916154446-c6d0192ebb9d 16 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-rc.0.0.20260915230720-610d8d896ef8 15 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-rc.0 15 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260914164929-ee41a7864326 14 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260910170331-f6132dbe1f48 10 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260910143931-63ea46d0fdd5 10 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260910060017-157bbc972050 10 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260909003214-c1fc1a51d193 09 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260908115616-3264a09dff64 08 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260907154452-e5e07573b1a5 07 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260906173735-6effe52c5372 06 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260905165514-827a2231e8a2 05 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260905000702-c003f88b8d19 05 Sep 2026 M3 Apache-2.0 Yes Details →
v2.0.12 04 Sep 2026 M3 Apache-2.0 Yes Details →
v2.2.8 04 Sep 2026 M3 Apache-2.0 Yes Details →
v2.3.5 04 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260904180138-a2d2eabba4e3 04 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260904175937-8dd0970b3c73 04 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260903170904-84ae70638948 03 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260902010341-282a4b9560c4 02 Sep 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260901013845-3ee1777312f3 01 Sep 2026 M3 Apache-2.0 Yes Details →
v2.0.12-0.20260831221339-6c060c9525bd 31 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260831174402-d5a5c42de9be 31 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260828191722-716cbaf51212 28 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260828141721-bb5988d3d1da 28 Aug 2026 M3 Apache-2.0 Yes Details →
v2.3.5-0.20260828141634-3684f8651b11 28 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260827232146-d18d1b5913cd 27 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260827211034-7e66a3f76aef 27 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260827004119-a9eb76fb198e 27 Aug 2026 M3 Apache-2.0 Yes Details →
v2.2.8-0.20260826230633-c31c45f49908 26 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260825025332-e6618451086f 25 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260820131814-5090fb742cd1 20 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260820005834-f7302c343cfe 20 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260819190251-41ec0ef3da67 19 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260818204448-4d4d8b0ed293 18 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260817225226-1b23606c71a3 17 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260815233458-12e25b0096fb 15 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260814223515-e1bbb3df6a5c 14 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260813221114-675f21d00a62 13 Aug 2026 M3 Apache-2.0 Yes Details →
v2.2.7-0.20260813002040-f7075a224aa2 13 Aug 2026 M3 Apache-2.0 Yes Details →
v2.2.7 12 Aug 2026 M3 Apache-2.0 Yes Details →
v2.3.4 12 Aug 2026 M3 Apache-2.0 Yes Details →
v2.3.4-0.20260812174731-db8809540e1a 12 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0.0.20260812022320-01836f09d930 12 Aug 2026 M3 Apache-2.0 Yes Details →
v2.4.0-beta.0 10 Aug 2026 M3 Apache-2.0 Yes Details →
v2.3.1-0.20260808195946-35f120ed0ae8 08 Aug 2026 M3 Apache-2.0 Yes Details →
v2.3.1-0.20260807195724-76bcc3f9a822 07 Aug 2026 M3 Apache-2.0 Yes Details →
v2.3.1-0.20260805230734-05c6d4a86b9f 05 Aug 2026 M3 Apache-2.0 Yes Details →
v2.3.1-0.20260805163726-c9caf7e8cf07 05 Aug 2026 M3 — Yes Details →
v2.3.1-0.20260805024700-e28f4559035a 05 Aug 2026 M3 — Yes Details →
v2.3.1-0.20260802122121-d46562dbc976 02 Aug 2026 M3 — Yes Details →
v2.3.1-0.20260731212639-4dd56e55b81d 31 Jul 2026 M3 — Yes Details →
v2.3.4-0.20260724225855-63a4ba42a31a 24 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260724192445-8496e9ad6835 24 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260720221117-10b42e4ed52a 20 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260720205455-4b730651ee7c 20 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260719060654-0ed30a42b964 19 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260718062946-29edc6e8b7fe 18 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260717050524-cb23630be7e6 17 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260715080444-1ab181cb645a 15 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260712211621-ba015360dd68 12 Jul 2026 M3 — Yes Details →
v2.3.3 09 Jul 2026 M3 — Yes Details →
v2.2.6 09 Jul 2026 M3 — Yes Details →
v2.0.11 09 Jul 2026 M3 — Yes Details →
v2.0.11-0.20260709234318-ea0b49555e46 09 Jul 2026 M3 — Yes Details →
v2.2.6-0.20260709132426-fdad8f4d373f 09 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260709025448-af34190eb2d1 09 Jul 2026 M3 — Yes Details →
v2.3.1-0.20260705193346-2cb1afbe183a 05 Jul 2026 M3 — Yes Details →

The newest 120 of 747 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 5
  • 2026 8

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 8 of the 13 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/containerd/containerd/v2

The 5 most severe of 13 vulnerabilities recorded for this package

Search all 13 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-53492: containerd CRI Annotation Smuggling Vulnerability 8.4 high 2.1.9 19 Jun 2026
CVE-2026-95837: containerd CRI Plugin Vulnerability Allows Elevated Privileges via Checkpoint Restore 7.8 high 2.2.7 15 Oct 2026
CVE-2025-47290: containerd 2.1.0 Allows Host Filesystem Access During Image Pull 7.6 high 2.1.1 21 May 2025
CVE-2026-53489: containerd Arbitrary Host Log File Read via Symlink in CRI Checkpoint Restore 7.1 high 2.1.9 19 Jun 2026
CVE-2026-47262: containerd Denial of Service via Unbounded Group Parsing 6.9 medium 2.0.10 19 Jun 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/containerd/containerd/v2

Is github.com/containerd/containerd/v2 safe to use?

Vulert records 13 vulnerabilities for github.com/containerd/containerd/v2 in Go: 0 critical, 4 high, 7 medium and 0 low, plus 2 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/containerd/containerd/v2's Vulert package health score?

Vulert scores github.com/containerd/containerd/v2 78/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/containerd/containerd/v2 affected?

Yes. v2.4.2, the version you would install today, has 3 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/containerd/containerd/v2 have?

13 vulnerabilities are recorded for github.com/containerd/containerd/v2 in the Go ecosystem: 0 critical, 4 high, 7 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/containerd/containerd/v2 vulnerabilities disclosed?

8 vulnerabilities were recorded for github.com/containerd/containerd/v2 in the last 12 months, and the oldest entry in this database dates to 17 Mar 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/containerd/containerd/v2 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/containerd/containerd/v2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/containerd/containerd/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.