USN-8471-1

It was discovered that containerd incorrectly handled HTTP/2 SETTINGS frames. A remote attacker could possibly use this issue to cause containerd to enter an infinite loop, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2026-33814)

Jakub Ciolek and Kyle Elliott discovered that containerd incorrectly handled group parsing when creating containers from images. An attacker could possibly use this issue to cause containerd to consume excessive memory, resulting in a denial of service. (CVE-2026-47262)

Robert Prast discovered that containerd incorrectly propagated labels from image configurations to containers. An attacker could possibly use this issue to execute arbitrary code on the host. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-53488)

References

Affected packages

Ubuntu:22.04:LTS

containerd

Package

Name: containerd
Purl: pkg:deb/ubuntu/containerd?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.12-0ubuntu1~22.04.11

Affected versions

1.*

1.5.5-0ubuntu3

1.5.9-0ubuntu1

1.5.9-0ubuntu2

1.5.9-0ubuntu3

1.5.9-0ubuntu3.1

1.6.12-0ubuntu1~22.04.1

1.6.12-0ubuntu1~22.04.3

1.6.12-0ubuntu1~22.04.5

1.6.12-0ubuntu1~22.04.6

1.6.12-0ubuntu1~22.04.7

1.6.12-0ubuntu1~22.04.8

1.6.12-0ubuntu1~22.04.9

1.6.12-0ubuntu1~22.04.10

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.6.12-0ubuntu1~22.04.11"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8471-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33814"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-47262"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "high"
                }
            ],
            "id": "CVE-2026-53488"
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}

Ubuntu:Pro:16.04:LTS

containerd

Package

Name: containerd
Purl: pkg:deb/ubuntu/containerd?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.6-0ubuntu1~16.04.6+esm7

Affected versions

0.*

0.2.1-0ubuntu4~16.04

0.2.3-0ubuntu1~16.04

0.2.5-0ubuntu1~16.04.1

1.*

1.2.6-0ubuntu1~16.04.2

1.2.6-0ubuntu1~16.04.3

1.2.6-0ubuntu1~16.04.4

1.2.6-0ubuntu1~16.04.5

1.2.6-0ubuntu1~16.04.6

1.2.6-0ubuntu1~16.04.6+esm1

1.2.6-0ubuntu1~16.04.6+esm2

1.2.6-0ubuntu1~16.04.6+esm4

1.2.6-0ubuntu1~16.04.6+esm5

1.2.6-0ubuntu1~16.04.6+esm6

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "containerd",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
        },
        {
            "binary_name": "golang-github-docker-containerd-dev",
            "binary_version": "1.2.6-0ubuntu1~16.04.6+esm7"
        }
    ],
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8471-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33814"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-47262"
        }
    ],
    "ecosystem": "Ubuntu:Pro:16.04:LTS"
}

Ubuntu:Pro:18.04:LTS

containerd

Package

Name: containerd
Purl: pkg:deb/ubuntu/containerd?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.12-0ubuntu1~18.04.1+esm4

Affected versions

0.*

0.2.5-0ubuntu2

1.*

1.2.6-0ubuntu1~18.04.1

1.2.6-0ubuntu1~18.04.2

1.3.3-0ubuntu1~18.04.1

1.3.3-0ubuntu1~18.04.2

1.3.3-0ubuntu1~18.04.3

1.3.3-0ubuntu1~18.04.4

1.4.4-0ubuntu1~18.04.2

1.5.2-0ubuntu1~18.04.1

1.5.2-0ubuntu1~18.04.2

1.5.2-0ubuntu1~18.04.3

1.5.5-0ubuntu3~18.04.1

1.5.5-0ubuntu3~18.04.2

1.5.9-0ubuntu1~18.04.1

1.5.9-0ubuntu1~18.04.2

1.6.12-0ubuntu1~18.04.1

1.6.12-0ubuntu1~18.04.1+esm1

1.6.12-0ubuntu1~18.04.1+esm2

1.6.12-0ubuntu1~18.04.1+esm3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "containerd",
            "binary_version": "1.6.12-0ubuntu1~18.04.1+esm4"
        },
        {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.6.12-0ubuntu1~18.04.1+esm4"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8471-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33814"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-47262"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "high"
                }
            ],
            "id": "CVE-2026-53488"
        }
    ],
    "ecosystem": "Ubuntu:Pro:18.04:LTS"
}

Ubuntu:Pro:20.04:LTS

containerd

Package

Name: containerd
Purl: pkg:deb/ubuntu/containerd?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.12-0ubuntu1~20.04.8+esm2

Affected versions

1.*

1.2.10-0ubuntu1

1.3.2-0ubuntu1

1.3.3-0ubuntu1

1.3.3-0ubuntu2

1.3.3-0ubuntu2.1

1.3.3-0ubuntu2.2

1.3.3-0ubuntu2.3

1.4.4-0ubuntu1~20.04.2

1.5.2-0ubuntu1~20.04.1

1.5.2-0ubuntu1~20.04.2

1.5.2-0ubuntu1~20.04.3

1.5.5-0ubuntu3~20.04.1

1.5.5-0ubuntu3~20.04.2

1.5.9-0ubuntu1~20.04.1

1.5.9-0ubuntu1~20.04.4

1.5.9-0ubuntu1~20.04.5

1.5.9-0ubuntu1~20.04.6

1.6.12-0ubuntu1~20.04.1

1.6.12-0ubuntu1~20.04.3

1.6.12-0ubuntu1~20.04.5

1.6.12-0ubuntu1~20.04.6

1.6.12-0ubuntu1~20.04.7

1.6.12-0ubuntu1~20.04.8

1.6.12-0ubuntu1~20.04.8+esm1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.6.12-0ubuntu1~20.04.8+esm2"
        }
    ],
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8471-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-33814"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-47262"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "high"
                }
            ],
            "id": "CVE-2026-53488"
        }
    ],
    "ecosystem": "Ubuntu:Pro:20.04:LTS"
}

Ubuntu:Pro:24.04:LTS

containerd

Package

Name: containerd
Purl: pkg:deb/ubuntu/containerd?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.6.24~ds1-1ubuntu1.3+esm3

Affected versions

1.*

1.6.20~ds1-1ubuntu2

1.6.24~ds1-1ubuntu1

1.6.24~ds1-1ubuntu1.1

1.6.24~ds1-1ubuntu1.2

1.6.24~ds1-1ubuntu1.2+esm1

1.6.24~ds1-1ubuntu1.3

1.6.24~ds1-1ubuntu1.3+esm1

1.6.24~ds1-1ubuntu1.3+esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.6.24~ds1-1ubuntu1.3+esm3"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8471-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-47262"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "high"
                }
            ],
            "id": "CVE-2026-53488"
        }
    ],
    "ecosystem": "Ubuntu:Pro:24.04:LTS"
}

Ubuntu:Pro:26.04:LTS

containerd

Package

Name: containerd
Purl: pkg:deb/ubuntu/containerd?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.7.24~ds1-10ubuntu1+esm1

Affected versions

1.*

1.7.24~ds1-8ubuntu1

1.7.24~ds1-10ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "golang-github-containerd-containerd-api-dev",
            "binary_version": "1.7.24~ds1-10ubuntu1+esm1"
        },
        {
            "binary_name": "golang-github-containerd-containerd-dev",
            "binary_version": "1.7.24~ds1-10ubuntu1+esm1"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8471-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-47262"
        },
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "high"
                }
            ],
            "id": "CVE-2026-53488"
        }
    ],
    "ecosystem": "Ubuntu:Pro:26.04:LTS"
}