github.com/opencontainers/runc vulnerabilities — 37 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
Unrated CVE-2026-41579: Vulnerability in github.com/opencontainers/runc Due to Malicious Image with /dev Symlink github.com/opencontainers/runc Go 07 Jul 2026 1.3.6
3.3 medium CVE-2026-41579: runc Vulnerability Allowing Host Filesystem Integrity Violations via Malicious Symlinks github.com/opencontainers/runc Go 22 Jun 2026 1.3.6
Unrated CVE-2025-52881: Container Escape and DDoS in github.com/opencontainers/runc github.com/opencontainers/runc Go 18 Nov 2025 1.2.8
Unrated CVE-2025-52565: Container Escape Vulnerability in github.com/opencontainers/runc github.com/opencontainers/runc Go 18 Nov 2025 1.2.8
Unrated CVE-2025-31133: Container Escape Vulnerability in github.com/opencontainers/runc Due to Mount Race Conditions github.com/opencontainers/runc Go 18 Nov 2025 1.2.8
7.3 high CVE-2025-52881: runc Container Escape and Denial of Service via Arbitrary Write Gadgets github.com/opencontainers/runc Go 05 Nov 2025 1.2.8
7.3 high CVE-2025-52565: runc Container Escape via Malicious Config and /dev/console Mount github.com/opencontainers/runc Go 05 Nov 2025 1.2.8
7.3 high CVE-2025-31133: runc Container Escape via Masked Path Abuse and Mount Race Conditions github.com/opencontainers/runc Go 05 Nov 2025 1.2.8
Unrated CVE-2025-27612: Capabilities Elevation in github.com/opencontainers/runc github.com/opencontainers/runc Go 25 Mar 2025 No fix published
Unrated CVE-2024-45310: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc github.com/opencontainers/runc Go 06 Sep 2024 1.1.14
3.6 medium CVE-2024-45310: runc can be tricked into creating empty files/directories on the host github.com/opencontainers/runc Go 03 Sep 2024 1.1.14
Unrated CVE-2021-30465: Mount Destination Swap Vulnerability in github.com/opencontainers/runc github.com/opencontainers/runc Go 21 Aug 2024 1.0.0-rc95
Unrated CVE-2016-9962: Information Exposure in RunC in github.com/opencontainers/runc github.com/opencontainers/runc Go 21 Aug 2024 1.0.0-rc3
Unrated CVE-2022-29162: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc github.com/opencontainers/runc Go 21 Aug 2024 1.1.2
Unrated devices resource list treated as a blacklist by default in github.com/opencontainers/runc github.com/opencontainers/runc Go 21 Aug 2024 1.0.0-rc91
Unrated CVE-2023-28642: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc github.com/opencontainers/runc Go 20 Aug 2024 1.1.5
Unrated CVE-2023-25809: rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc github.com/opencontainers/runc Go 20 Aug 2024 1.1.5
Unrated CVE-2023-27561: Opencontainers runc Incorrect Authorization Vulnerability github.com/opencontainers/runc Go 20 Aug 2024 1.1.5
Unrated CVE-2024-21626: Container Breakout Vulnerability in github.com/opencontainers/runc github.com/opencontainers/runc Go 28 Jun 2024 1.1.12
7.2 high CVE-2024-3154: Arbitrary systemd Property Injection in Runc github.com/opencontainers/runc Go 26 Apr 2024 1.2.0-rc.1
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.