Github.com/opencontainers/runc
16 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Github.com/opencontainers/runc, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Github.com/opencontainers/runc CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 3 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 16 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High9
- Medium5
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Github.com/opencontainers/runc.
- CVE-2025-52881runc: LSM labels can be bypassed with malicious config using dummy procfs files7.5
- CVE-2025-52565container escape due to /dev/console mount and related races7.5
- CVE-2025-31133runc container escape via "masked path" abuse due to mount race conditions7.8
- CVE-2024-45310runc can be confused to create empty files/directories on the host3.6
- CVE-2024-21626runc container breakout through process.cwd trickery and leaked fds8.6
- CVE-2023-25809rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc5.0
- CVE-2023-28642AppArmor bypass with symlinked /proc in runc6.1
- CVE-2023-27561runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with ...7.0
- CVE-2022-29162Incorrect Default Permissions in runc5.9
- GHSA-g54h-m393-cpwqdevices resource list treated as a blacklist by default—
- CVE-2021-43784Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration6.0
- CVE-2021-30465runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mo...8.5
- CVE-2019-19921runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers w...7.0
- CVE-2019-16884runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a...7.5
- CVE-2016-9962RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file...6.4
Product grouping is registry-driven, with AI assist and human review. How it works