{"schema":"threatline.record/2","record":{"id":"GHSA-hc94-p972-ch66","aliases":["GHSA-hc94-p972-ch66"],"summary":"containerd: host disk exhaustion when pulling an image with an unbounded layer stream","details":"### Impact\r\n\r\nA bug in containerd's image pull process can cause containerd to exhaust host disk space when downloading image layers. When pulling an image, containerd streams layer data into its content store without bounding incoming bytes to the declared size before validation. Downloading a crafted image or pulling from a malicious registry can cause containerd to continuously write data to the host filesystem until disk space is exhausted. In Kubernetes, this resource exhaustion can trigger node disk pressure, render the kubelet and containerd unresponsive, and block new pod startup.\r\n\r\n### Patches\r\n\r\nThis bug has been fixed in containerd 2.4.2, 2.3.7, 2.2.10, and 2.0.14. Users should update to these versions to resolve the issue.\r\n\r\n### Workarounds\r\n\r\nRestrict pod image references to trusted registries (for example, using a Kubernetes `ValidatingAdmissionPolicy` or admission webhook).\r\n\r\n### Credits\r\n\r\nThe containerd project would like to thank Jakub Ciolek of AlphaSense for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\r\n\r\n### For more information\r\n\r\nIf you have any questions or comments about this advisory:\r\n\r\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\r\n* Email us at [security@containerd.io](mailto:security@containerd.io)\r\n\r\nTo report a security issue in containerd:\r\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\r\n* Email us at [security@containerd.io](mailto:security@containerd.io)","categories":["Containers & cloud"],"product":"github.com/containerd/containerd/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66","source_modified_at":"2026-10-13T22:50:43Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"range":">= 2.0.0, < 2.0.14, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.7, >= 2.4.0, < 2.4.2"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66","source_modified_at":"2026-10-13T22:50:43Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"version":"2.4.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66","source_modified_at":"2026-10-13T22:50:43Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"version":"2.3.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66","source_modified_at":"2026-10-13T22:50:43Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"version":"2.2.10"},{"source":"GitHub Advisory Database","source_url":"https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66","source_modified_at":"2026-10-13T22:50:43Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/containerd/containerd/v2"},"version":"2.0.14"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-13T22:50:43Z","modified_at":"2026-10-13T22:50:43Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/containerd/containerd/security/advisories/GHSA-hc94-p972-ch66","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-13T22:50:43Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-13T22:50:43Z","content_hash":"fde70e2705c96d15742cadcf01c333062ff3f6c3210e23d25ad8fab4ea4c0e1d"}}