containerd: Unpack DoS via repeated opaque whiteouts

containerd CRI plugin: Checkpoint restore bypasses destination security context

Containerd has image-pull DoS via crafted OCI index graph amplification

containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service

containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

containerd CRI checkpoint restore CDI annotation smuggling

containerd: CRI checkpoint import allows local image tag poisoning

containerd image-triggered runtime DoS via unbounded group parsing

containerd user ID handling bypass allows runAsNonRoot evasion

containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

containerd CRI server: Host memory exhaustion through Attach goroutine leak

containerd affected by a local privilege escalation via wide permissions on CRI directory

containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.

Containerd vulnerable to host filesystem access during image unpack

containerd has an integer overflow in User ID handling

containerd supplementary groups are not set up properly

containerd OCI image importer memory exhaustion

containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

containerd CRI plugin: Host memory exhaustion through ExecSync

Insecure handling of image volumes in containerd CRI plugin

Improper Preservation of Permissions in containerd

Insufficiently restricted permissions on plugin directories

Archive package allows chmod of file outside of unpack target directory

environment variable leak

containerd-shim API Exposed to Host Network Containers

containerd can be coerced into leaking credentials during image pull