StackRadar

CVE-2026-47262

Medium

Advisory

Published 19 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
191
of 17,781 indexed, latest versions
Container images
199
deployed by those charts
Fix available
2 of 3
affected packages

containerd image-triggered runtime DoS via unbounded group parsing

Carried by container images the latest versions of 191 of 17,781 indexed charts deploy, on 199 images.

Affected packageAffected versionsFixed inImages
github.com/containerd/containerdgolangv1.7.0, v1.7.1, v1.7.2, v1.7.3+23 more1.7.33175
github.com/containerd/containerd/v2golangv2.0.2, v2.0.4, v2.1.1, v2.1.3+10 more2.0.10, 2.1.9, 2.2.5, 2.3.230
containerddeb1.6.20~ds1-1+deb12u3no fix listed1
OSV records
DEBIAN-CVE-2026-47262GHSA-jpcc-p29g-p8mq
Also known as
GO-2026-5475

Charts affected

191 by stars
ChartLatestAffected imagesRadar Score
agent-control-cdnewrelic1.0.02 of 3See more

agent-control-cd newrelic 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
github.com/containerd/containerd@v1.7.24
1.7.33
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
github.com/containerd/containerd@v1.7.24
1.7.33

Open the chart page →

5,034
lensoci-ai-incubations0.1.141 of 16See more

lens oci-ai-incubations 0.1.14

1 of the 16 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
github.com/containerd/containerd@v1.7.27
1.7.33

Open the chart page →

17,070
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
github.com/containerd/containerd/v2@v2.0.4
2.0.10

Open the chart page →

6,037
pro-builderopenfaas0.6.131 of 2See more

pro-builder openfaas 0.6.13

1 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/openfaasltd/pro-builder:0.6.06c17297f9098
github.com/containerd/containerd/v2@v2.2.3
2.2.5

Open the chart page →

2,726
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/containerd/containerd@v1.7.23
1.7.33

Open the chart page →

2,525
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/containerd/containerd@v1.7.29
1.7.33

Open the chart page →

4,127
operator-lifecycle-manageroperator-lifecycle-manager1.2.22 of 2See more

operator-lifecycle-manager operator-lifecycle-manager 1.2.2

2 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/containerd/containerd@v1.7.30
1.7.33
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/containerd/containerd@v1.7.30
1.7.33

Open the chart page →

1,821
opslevelopslevelVerified publisher2025.1.221 of 10See more

opslevel opslevel 2025.1.22

1 of the 10 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
replicated/replicated-sdk:1.0.0-beta.318751b4963250
github.com/containerd/containerd@v1.7.12
1.7.33

Open the chart page →

5,554
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.02 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

2 of the 40 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
github.com/containerd/containerd@v1.7.11
1.7.33
gcr.io/kaniko-project/executor:latest4e7a52dd1f14
github.com/containerd/containerd@v1.7.27
github.com/containerd/containerd/v2@v2.1.1
1.7.33
2.1.9

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
github.com/containerd/containerd@v1.7.11
1.7.33

Open the chart page →

6,583
parcaparca-rr0.1.01 of 2See more

parca parca-rr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
github.com/containerd/containerd@v1.7.27
1.7.33

Open the chart page →

2,366
pixie-operator-chartpixie0.1.71 of 3See more

pixie-operator-chart pixie 0.1.7

1 of the 3 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned1b6002156f56
github.com/containerd/containerd@v1.7.11
1.7.33

Open the chart page →

1,899
planectlplanectlVerified publisher0.7.03 of 10See more

planectl planectl 0.7.0

3 of the 10 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
alpine/k8s:1.30.2cd560fce90f7
github.com/containerd/containerd@v1.7.13
1.7.33
gitea/act_runner:0.2.11c57233403eff
github.com/containerd/containerd@v1.7.13
1.7.33
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/containerd/containerd@v1.7.23
1.7.33

Open the chart page →

25,934
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
github.com/containerd/containerd@v1.7.24
1.7.33

Open the chart page →

11,151
tenant-namespace-operatorpnnl-miscscripts0.1.281 of 1See more

tenant-namespace-operator pnnl-miscscripts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
github.com/containerd/containerd@v1.7.28
1.7.33

Open the chart page →

12,754
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
github.com/containerd/containerd@v1.7.29
1.7.33

Open the chart page →

2,751
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
github.com/containerd/containerd@v1.7.29
1.7.33

Open the chart page →

3,270
headlampradar-baseVerified publisher1.0.01 of 1See more

headlamp radar-base 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.43.05d03caa26df7
github.com/containerd/containerd@v1.7.32
1.7.33

Open the chart page →

613
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/containerd/containerd@v1.7.27
1.7.33

Open the chart page →

1,837
sonatype-nexusredhat-cop1.1.131 of 2See more

sonatype-nexus redhat-cop 1.1.13

1 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/containerd/containerd@v1.7.0
1.7.33

Open the chart page →

16,047
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
github.com/containerd/containerd@v1.7.20
1.7.33

Open the chart page →

7,084
krr-enforcerrobusta0.3.51 of 2See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
alpine/k8s:1.30.0bd01dae02676
github.com/containerd/containerd@v1.7.11
1.7.33

Open the chart page →

4,038
mailserverrock8sVerified publisher0.1.21 of 1See more

mailserver rock8s 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
registry.gitlab.com/bitspur/rock8s/images/kube-commands:3.1880ef8ceffc92
github.com/containerd/containerd@v1.7.6
1.7.33

Open the chart page →

1,946
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
github.com/containerd/containerd@v1.7.18
1.7.33

Open the chart page →

9,607
devtron-enterpriseromholdings48.0.03 of 28See more

devtron-enterprise romholdings 48.0.0

3 of the 28 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
github.com/containerd/containerd@v1.7.30
1.7.33
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/containerd/containerd@v1.7.5
1.7.33
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
github.com/containerd/containerd@v1.7.29
1.7.33

Open the chart page →

68,240
devtron-operatorromholdings0.23.32 of 11See more

devtron-operator romholdings 0.23.3

2 of the 11 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
github.com/containerd/containerd@v1.7.30
1.7.33
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
github.com/containerd/containerd@v1.7.29
1.7.33

Open the chart page →

32,902
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
github.com/containerd/containerd@v1.7.28
1.7.33

Open the chart page →

5,819
olmsikalabs0.3.01 of 2See more

olm sikalabs 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned40d0363f4aa6
github.com/containerd/containerd@v1.7.16
1.7.33

Open the chart page →

1,146
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
github.com/containerd/containerd@v1.7.19
1.7.33

Open the chart page →

2,429
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/containerd/containerd@v1.7.0
1.7.33

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
github.com/containerd/containerd@v1.7.3
1.7.33

Open the chart page →

2,505
switchbladeswitchblade0.0.191 of 1See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
github.com/containerd/containerd@v1.7.12
1.7.33

Open the chart page →

1,360
act-runnertektonops0.1.22 of 2See more

act-runner tektonops 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
github.com/containerd/containerd@v1.7.29
1.7.33
library/docker:23.0.6-dindafa5d5134900
github.com/containerd/containerd@v1.7.2
1.7.33

Open the chart page →

4,212
terminusterminusVerified publisher1.1.01 of 1See more

terminus terminus 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/containerd/containerd/v2@v2.2.2
2.2.5

Open the chart page →

631
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.42.0c9754bae1d79
github.com/containerd/containerd@v1.7.30
1.7.33

Open the chart page →

7,637
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
github.com/containerd/containerd@v1.7.27
1.7.33

Open the chart page →

1,331
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
github.com/containerd/containerd@v1.7.27
1.7.33

Open the chart page →

1,322
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/containerd/containerd@v1.7.16
1.7.33

Open the chart page →

2,477
traceetrivy-operator0.24.11 of 1See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
aquasec/tracee:0.24.1cfbbfee972e6
github.com/containerd/containerd@v1.7.29
1.7.33

Open the chart page →

1,074
tfy-karpentertruefoundryVerified publisher0.5.111 of 3See more

tfy-karpenter truefoundry 0.5.11

1 of the 3 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent:v1.5.1-eksbuild.1988c8e1a273a
github.com/containerd/containerd@v1.7.30
1.7.33

Open the chart page →

645
rancherwenerme2.15.12 of 2See more

rancher wenerme 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-47262.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.2
rancher/shell:v0.8.1f293af9c635f
github.com/containerd/containerd@v1.7.32
github.com/containerd/containerd/v2@v2.2.4
1.7.33
2.2.5

Open the chart page →

1,456

Container images carrying it

199 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
keelhq/keel:latest73714afb4443
github.com/containerd/containerd@v1.7.24
1.7.33
5
rancher/rancher:v2.15.15f6c4dc52a05
github.com/containerd/containerd/v2@v2.3.2-k3s2
2.3.2
4
rancher/shell:v0.8.1f293af9c635f
github.com/containerd/containerd@v1.7.32
github.com/containerd/containerd/v2@v2.2.4
1.7.33
2.2.5
4
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
github.com/containerd/containerd@v1.7.1
1.7.33
4
ethpandaops/tracoor:latestd8514b9f4c59
github.com/containerd/containerd@v1.7.18
1.7.33
3
quay.io/devtron/ai-agent:0.0.16545dac92173
github.com/containerd/containerd@v1.7.18
1.7.33
3
quay.io/devtron/chart-sync:94237c18-1021-3941960566529446a
github.com/containerd/containerd@v1.7.30
1.7.33
3
quay.io/devtron/chart-sync:3b3d6d0e-836-39296721b5c9634d4
github.com/containerd/containerd@v1.7.30
1.7.33
3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/containerd/containerd@v1.7.5
1.7.33
3
quay.io/devtron/kubelink:94237c18-314-394179d25865295af
github.com/containerd/containerd@v1.7.29
1.7.33
3
quay.io/devtron/kubelink:09867a9c-564-39289ea6dd1e4ce71
github.com/containerd/containerd@v1.7.29
1.7.33
3
alpine/k8s:1.32.12048f8d9c8cc7
github.com/containerd/containerd@v1.7.28
1.7.33
2
dtzar/helm-kubectl:3.14.455429449408e
github.com/containerd/containerd@v1.7.12
1.7.33
2
ilum/api:6.7.3624fd09528c8
github.com/containerd/containerd@v1.7.24
1.7.33
2
inaccel/daemon:latest093e1ea90ab8
github.com/containerd/containerd@v1.7.13
1.7.33
2
library/arangodb:3.11.81e75d74954a4
github.com/containerd/containerd@v1.7.11
1.7.33
2
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
github.com/containerd/containerd@v1.7.27
1.7.33
2
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/containerd/containerd/v2@v2.1.1
2.1.9
2
ghcr.io/appscode/fargocd:v0.0.31f5c791fc54d
github.com/containerd/containerd@v1.7.32
1.7.33
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
github.com/containerd/containerd@v1.7.27
1.7.33
2
ghcr.io/containerd/nydus-snapshotter:v0.9.056f8617363b4
github.com/containerd/containerd@v1.7.0
1.7.33
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
github.com/containerd/containerd@v1.7.23
1.7.33
2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
github.com/containerd/containerd@v1.7.29
1.7.33
2
1dev/server:11.9.0cd5b12fe5471
github.com/containerd/containerd/v2@v2.0.4
2.0.10
1
alpine/helm105741fa6621
github.com/containerd/containerd@v1.7.12
1.7.33
1
alpine/k8s:1.27.321b24e6bf801
github.com/containerd/containerd@v1.7.0
1.7.33
1
alpine/k8s:1.36.244ef4942e171
github.com/containerd/containerd@v1.7.30
1.7.33
1
alpine/k8s:1.31.106dbe6f391eda
github.com/containerd/containerd@v1.7.27
1.7.33
1
alpine/k8s:1.31.137a319b15cfc9
github.com/containerd/containerd@v1.7.28
1.7.33
1
alpine/k8s:1.32.47e1e7d5b7a96
github.com/containerd/containerd@v1.7.27
1.7.33
1
alpine/k8s:1.31.49c4976d47656
github.com/containerd/containerd@v1.7.12
1.7.33
1
alpine/k8s:1.35.6b7a12c5ddf26
github.com/containerd/containerd@v1.7.30
1.7.33
1
alpine/k8s:1.30.0bd01dae02676
github.com/containerd/containerd@v1.7.11
1.7.33
1
alpine/k8s:1.30.2cd560fce90f7
github.com/containerd/containerd@v1.7.13
1.7.33
1
alpine/k8s:1.35.5d870622d0040
github.com/containerd/containerd@v1.7.30
1.7.33
1
alpine/k8s:1.28.13e5c0b053fed7
github.com/containerd/containerd@v1.7.12
1.7.33
1
alpine/k8s:1.32.3eec354133193
github.com/containerd/containerd@v1.7.24
1.7.33
1
alpine/k8s:1.28.2fc059f056ad0
github.com/containerd/containerd@v1.7.6
1.7.33
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/containerd/containerd@v1.7.29
1.7.33
1
appwrite/appwrite:1.9.01aaa70127114
github.com/containerd/containerd/v2@v2.1.4
2.1.9
1
appwrite/appwrite:1.9.6adc7d0e7ec23
github.com/containerd/containerd/v2@v2.1.4
2.1.9
1
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/containerd/containerd@v1.7.16
1.7.33
1
aquasec/tracee:0.24.1cfbbfee972e6
github.com/containerd/containerd@v1.7.29
1.7.33
1
aquasec/trivy:0.43.1944a04445179
github.com/containerd/containerd@v1.7.0
1.7.33
1
aquasec/trivy:0.69.3bcc376de8d77
github.com/containerd/containerd@v1.7.29
github.com/containerd/containerd/v2@v2.2.0
1.7.33
2.2.5
1
artifacthub/hub:v1.19.0111918d8c399
github.com/containerd/containerd@v1.7.17
1.7.33
1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/containerd/containerd@v1.7.29
github.com/containerd/containerd/v2@v2.2.0
1.7.33
2.2.5
1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/containerd/containerd@v1.7.13
1.7.33
1
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/containerd/containerd@v1.7.28
1.7.33
1
artifacthub/tracker:v1.19.06596c8c4d955
github.com/containerd/containerd@v1.7.11
1.7.33
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.