{"schema":"threatline.record/2","record":{"id":"GHSA-8647-2jxj-p2rc","aliases":["GHSA-8647-2jxj-p2rc"],"summary":"containerd: daemon crash when pulling an image with a crafted Content-Length header","details":"### Impact\r\n\r\nA bug in containerd's image pull process can cause containerd to crash when downloading layers from an untrusted registry. When parallel layer fetch is enabled, an untrusted registry returning a crafted `Content-Length` header can trigger an unhandled memory allocation panic. This issue only affects configurations where `concurrent_layer_fetch_buffer` is set to enable parallel layer fetch; default configurations with this setting disabled are not affected. A daemon crash interrupts in-flight container operations and blocks new pod startup until containerd is restarted by a service manager, though existing running containers remain unaffected.\r\n\r\n### Patches\r\n\r\nThis bug has been fixed in containerd 2.4.2, 2.3.7, and 2.2.10. Users should update to these versions to resolve the issue.\r\n\r\n### Workarounds\r\n\r\nEnsure `concurrent_layer_fetch_buffer` is set to `0` (the default) or omitted in containerd's configuration under `[plugins.\"io.containerd.transfer.v1.local\"]` and `[plugins.\"io.containerd.cri.v1.images\"]` to disable parallel layer fetch. Restrict pod image references to trusted registries (for example, using a Kubernetes `ValidatingAdmissionPolicy` or admission webhook).\r\n\r\n### Credits\r\n\r\nThe containerd project would like to thank Opensec Intelligence for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\r\n\r\n### For more information\r\n\r\nIf you have any questions or comments about this advisory:\r\n\r\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\r\n* Email us at [security@containerd.io](mailto:security@containerd.io)\r\n\r\nTo report a security issue in containerd:\r\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\r\n* Email us at [security@containerd.io](mailto:security@containerd.io)","categories":["Containers & cloud"],"product":"github.com/containerd/containerd/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc","source_modified_at":"2026-10-13T22:53:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"range":">= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.7, >= 2.4.0, < 2.4.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc","source_modified_at":"2026-10-13T22:53:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"version":"2.2.10"},{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc","source_modified_at":"2026-10-13T22:53:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"version":"2.3.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc","source_modified_at":"2026-10-13T22:53:58Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"version":"2.4.2"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-13T22:53:58Z","modified_at":"2026-10-13T22:53:58Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-13T22:53:58Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-13T22:53:58Z","content_hash":"28cff9d8ef95b25b293a10025b705585cd19535b578dcb35a5ab10f75c230d6e"}}