An update for containerd is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2893 Final 1.0 1.0 2026-07-09 Initial 2026-07-09 2026-07-09 openEuler SA Tool V1.0 2026-07-09 containerd security update An update for containerd is now available for openEuler-20.03-LTS-SP4 containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc. Security Fix(es): containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.(CVE-2026-47262) containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.(CVE-2026-53488) An update for containerd is now available for openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High containerd https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2893 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-47262 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-53488 https://nvd.nist.gov/vuln/detail/CVE-2026-47262 https://nvd.nist.gov/vuln/detail/CVE-2026-53488 openEuler-20.03-LTS-SP4 containerd-1.2.0-225.oe2003sp4.x86_64.rpm containerd-1.2.0-225.oe2003sp4.aarch64.rpm containerd-1.2.0-225.oe2003sp4.src.rpm containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2. 2026-07-09 CVE-2026-47262 openEuler-20.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H containerd security update 2026-07-09 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2893 containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10. 2026-07-09 CVE-2026-53488 openEuler-20.03-LTS-SP4 High 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H containerd security update 2026-07-09 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2893