VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/opencontainers/runc: vulnerability history, versions and safety

github.com/opencontainers/runc is a package in the Go ecosystem. Vulert records 37 vulnerabilities for it across 120 releases, from Apr 2021 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
37 vulnerabilities recorded H9 M7 L2 U19
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
8 in the last 12 months

Most recent disclosure 07 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/opencontainers/runc vulnerabilities

Vulert verdict on github.com/opencontainers/runc v1.5.2 i

Updated on 22 Oct 2026

Careful: v1.5.2 has 30 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.5.2 — affected i
  • Vulnerabilities on record 37 over 5 years · 8 in the last year i
  • Latest disclosure 07 Jul 2026 i
  • Highest CVSS 8.6 i
  • With no published fix 1 i
  • Stars 13,498 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/opencontainers/runc, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.6.0-rc.1.0.20261021052916-976d95abc4ee 21 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261021020328-e488f6282910 21 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261020090055-1ffa70318557 20 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261020072851-ad40b6f3b541 20 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261017031433-2a603d366e0a 17 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261016222538-d2691cb3cb12 16 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261016064756-b1281089d47f 16 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261016055732-d6b6d8282ae6 16 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261016055203-c1044bf038f0 16 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261014034422-e6d915bf2b95 14 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261012112819-9068bd89fe3e 12 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261008100244-9e3a9a3ecd06 08 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1.0.20261006184200-5a56a54bf04b 06 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.6.0-rc.1 06 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20261005234310-0c66da955b7c 05 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20261003104840-ea8b6d42cd34 03 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20261002123740-ac1acef868c1 02 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20261002092140-f1afde059821 02 Oct 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260929003142-97f76a9b4601 29 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v0.0.0-20260924211222-29dd3dc2b13b 24 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.2 24 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260923051702-41b74772b651 23 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260922053315-530f61fe0070 22 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260917140141-c17aefd6c669 17 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260917052530-4cf07b29135d 17 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260914081113-579be222cf3e 14 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260910065100-930f199c7fca 10 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260907041230-0f52e5a72971 07 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260906081147-2f2161f2fd0a 06 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260904012657-7f999e2d2c95 04 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260903121442-68fbaabf63ef 03 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260903023955-0f962720e5b6 03 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260901090709-2ea7278cee3a 01 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260901015942-e6a99d4238fd 01 Sep 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260828085029-78e31d11716d 28 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260827211235-cb470207c6f4 27 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260824192505-9674194cc2b9 24 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260824053343-ac2b52edf7ca 24 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260824051735-c04437fbfbdf 24 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260819093507-76d9cf5da568 19 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260818235605-c010af1dea38 18 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260818035148-6c72bfe151ee 18 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260814220120-71747fb1b2f2 14 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260811001914-7495faeac773 11 Aug 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260729181853-0c87c02ff021 29 Jul 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260727202812-e2b8e8b83671 27 Jul 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260720214402-8d2f7df5cdcb 20 Jul 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.1 14 Jul 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v0.0.0-20260710012959-fc89fbd9ebec 10 Jul 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260710012959-fc89fbd9ebec 10 Jul 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260701221042-6689c8657e76 01 Jul 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260625103738-bc60126ec19f 25 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260624055456-4196f1294825 24 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260623182358-3a125a799d64 23 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0 19 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260619102019-881608b52a01 19 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260618163824-a8d82ce58059 18 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260618003148-c6f4361b832c 18 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260615094222-da3d022b06dd 15 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.3 13 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260613122757-122fb7a642c1 13 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.3.6 13 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.3 13 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260612161237-864db8042dbb 12 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260609180207-27354cd3d8cb 09 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260605092759-a7e766484c38 05 Jun 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260528045125-3047d61ff95f 28 May 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260511065036-0811f957a516 11 May 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v0.0.0-20260422121823-eb7eaf19b6ee 22 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260422121823-eb7eaf19b6ee 22 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260416190658-4ccedcbfe826 16 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260406180829-80fc1cd34e1e 06 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.2.0.20260403045429-fcec5762e2b2 03 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.2 03 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260403005800-7a1cae6dd028 03 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.2 02 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260402115034-a0d1b98e0680 02 Apr 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260331091344-348d92f497c4 31 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260330010942-400f3dd460e6 30 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260326044440-fe158d178183 26 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260319083240-837e98c98422 19 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.3.5 17 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260317012523-e1c1378fc924 17 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260315121124-496b68a30505 15 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1.0.20260313122825-5c48e2178120 13 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.5.0-rc.1 13 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.1 12 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260312124811-fd0388b2c477 12 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260307151603-5f3ac16d189d 07 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.2.10-0.20260305011522-9b5065bcedf8 05 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260305004311-c1c788765ca0 05 Mar 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260213013443-165a4a022957 13 Feb 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260204104332-92c80abae14c 04 Feb 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260129214934-cb31d62f1ca7 29 Jan 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260128162917-08072e936809 28 Jan 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260119151247-506a849db794 19 Jan 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20260109135138-3a4ffe806844 09 Jan 2026 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20251221050505-4246d6a0788c 21 Dec 2025 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20251218033319-0d788db46dc4 18 Dec 2025 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20251217012913-ef5e8a5505d6 17 Dec 2025 H6 M7 L2 U15 Apache-2.0 No Details →
v1.4.0-rc.1.0.20251216013909-4dcda051dad5 16 Dec 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251215060118-f29c4df140fa 15 Dec 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251205034358-e0adafb4cae1 05 Dec 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251203231930-14cc644c335b 03 Dec 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251203013512-fd185882e571 03 Dec 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251128113457-20a9532fd075 28 Nov 2025 H6 M7 L2 U15 — No Details →
v1.2.9 27 Nov 2025 H6 M7 L2 U15 — No Details →
v1.3.4 27 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0 27 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251126141259-52c3a0e79494 26 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251122070252-a7a402a7ea1d 22 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251121062216-21ad0e439911 21 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.3.0.20251120095202-9a05ab7cc240 20 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251112231449-59a5ff14a2c1 12 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251112092330-36667a33e297 12 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251111084718-996278a18986 11 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251110161001-eec1f7e34b33 10 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251110100530-5e40702bf194 10 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251108015848-95762b6ee1a8 08 Nov 2025 H6 M7 L2 U15 — No Details →
v1.4.0-rc.1.0.20251107091237-846835cce966 07 Nov 2025 H6 M7 L2 U15 — No Details →

The newest 120 of 7,538 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 10
  • 2022 3
  • 2023 3
  • 2024 12
  • 2025 7
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 8 of the 37 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/opencontainers/runc

The 5 most severe of 37 vulnerabilities recorded for this package

Search all 37 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-21626: runc vulnerable to container breakout through process.cwd trickery and leaked fds 8.6 high 1.1.12 31 Jan 2024
CVE-2016-3697: Privilege Elevation in runc 7.8 high 0.1.0 20 Dec 2021
CVE-2021-30465: runc - Mount Symlink Exchange Vulnerability 7.6 high 1.0.0-rc95 25 May 2021
CVE-2019-16884: Incorrect Authorization in runc 7.5 high 1.0.0-rc8.0.20190930145003-cad42f6e0932 22 Feb 2022
CVE-2025-52881: runc Container Escape and Denial of Service via Arbitrary Write Gadgets 7.3 high 1.2.8 05 Nov 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/opencontainers/runc

Is github.com/opencontainers/runc safe to use?

Vulert records 37 vulnerabilities for github.com/opencontainers/runc in Go: 0 critical, 9 high, 7 medium and 2 low, plus 19 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/opencontainers/runc's Vulert package health score?

Vulert scores github.com/opencontainers/runc 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/opencontainers/runc affected?

Yes. v1.5.2, the version you would install today, has 30 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/opencontainers/runc should I use?

v1.5.2 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/opencontainers/runc have?

37 vulnerabilities are recorded for github.com/opencontainers/runc in the Go ecosystem: 0 critical, 9 high, 7 medium and 2 low, plus 19 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/opencontainers/runc vulnerabilities disclosed?

8 vulnerabilities were recorded for github.com/opencontainers/runc in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/opencontainers/runc are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/opencontainers/runc for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/opencontainers/runc version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.