HIGHGo
GHSA-9493-h29p-rfm2· CVE-2025-31133, GO-2025-4096runc container escape via "masked path" abuse due to mount race conditions
Modified: 9/10/2026
package
Go/github.com/opencontainers/runc
pkg:go/github.com/opencontainers/runc
HIGH7.6Go
GHSA-c3xm-pvg7-gh7r· CVE-2021-30465, GO-2022-0914mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs
Modified: 9/10/2026
HIGHGo
GHSA-cgrx-mc8f-2prm· CVE-2025-52881, GO-2025-4098runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects
Modified: 9/10/2026
MEDIUM5.9Go
GHSA-f3fp-gc8g-vw66· CVE-2022-29162, GO-2022-0452Default inheritable capabilities for linux container should be empty
Modified: 9/10/2026
HIGH7.5Go
GHSA-fgv8-vj5c-2ppq· CVE-2019-16884, GO-2021-0085Incorrect Authorization in runc
Modified: 9/10/2026
MEDIUM5.9Go
GHSA-fh74-hm69-rqjw· CVE-2019-19921, GO-2021-0087opencontainers runc contains procfs race condition with a shared volume mount
Modified: 9/10/2026
MEDIUM6.1Go
GHSA-g2j6-57v7-gm8c· CVE-2023-28642, GO-2023-1683runc AppArmor bypass with symlinked /proc
Modified: 9/10/2026
LOWGo
GHSA-g54h-m393-cpwq· GO-2022-0396devices resource list treated as a blacklist by default
Modified: 9/10/2026
MEDIUM6.4Go
GHSA-gp4j-w3vj-7299· CVE-2016-9962, GO-2022-0835Information Exposure in RunC
Modified: 9/10/2026
LOW3.6Go
GHSA-jfvp-7x6p-h2pv· CVE-2024-45310, GO-2024-3110runc can be confused to create empty files/directories on the host
Modified: 9/10/2026
LOW2.5Go
GHSA-m8cg-xc2p-r3fc· CVE-2023-25809, GO-2023-1682rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
Modified: 9/10/2026
HIGH7.8Go
GHSA-q3j5-32m5-58c2· CVE-2016-3697, GO-2021-0070Privilege Elevation in runc
Modified: 9/10/2026
HIGHGo
GHSA-qw9x-cqr3-wc7r· CVE-2025-52565, GO-2025-4097runc container escape with malicious config due to /dev/console mount and related races
Modified: 9/10/2026
MEDIUM6.0Go
GHSA-v95c-p5hm-xq8f· CVE-2021-43784, GO-2022-0274Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration in RunC
Modified: 9/10/2026
HIGH7.0Go
GHSA-vpvm-3wq2-2wvm· CVE-2023-27561, GO-2023-1627Opencontainers runc Incorrect Authorization vulnerability
Modified: 9/10/2026
LOW3.3Go
GHSA-xjvp-4fhw-gc47· CVE-2026-41579, GO-2026-5761runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
Modified: 9/10/2026
HIGH8.6Go
GHSA-xr7r-f8xq-vfvv· CVE-2024-21626, GO-2024-2491runc vulnerable to container breakout through process.cwd trickery and leaked fds
Modified: 9/10/2026
—Go
GO-2021-0070· CVE-2016-3697, GHSA-q3j5-32m5-58c2Privilege escalation in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2021-0085· CVE-2019-16884, GHSA-fgv8-vj5c-2ppqAuthorization bypass in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2021-0087· CVE-2019-19921, GHSA-fh74-hm69-rqjwRace condition in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2022-0274· CVE-2021-43784, GHSA-v95c-p5hm-xq8fNamespace restriction bypass in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2022-0396· GHSA-g54h-m393-cpwqDevices resource list treated as a blacklist by default in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2022-0452· CVE-2022-29162, GHSA-f3fp-gc8g-vw66Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2022-0835· CVE-2016-9962, GHSA-gp4j-w3vj-7299Information Exposure in RunC in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2022-0914· CVE-2021-30465, GHSA-c3xm-pvg7-gh7rMount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2023-1627· CVE-2023-27561, GHSA-vpvm-3wq2-2wvmOpencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2023-1682· CVE-2023-25809, GHSA-m8cg-xc2p-r3fcRootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2023-1683· CVE-2023-28642, GHSA-g2j6-57v7-gm8cAppArmor bypass with symlinked /proc in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2024-2491· CVE-2024-21626, GHSA-xr7r-f8xq-vfvvContainer breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2024-3110· CVE-2024-45310, GHSA-jfvp-7x6p-h2pvCan be confused to create empty files/directories on the host in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2025-4096· CVE-2025-31133, GHSA-9493-h29p-rfm2Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2025-4097· CVE-2025-52565, GHSA-qw9x-cqr3-wc7rContainer escape with malicious config due to /dev/console mount and related races in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2025-4098· CVE-2025-52881, GHSA-cgrx-mc8f-2prmContainer escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc
Modified: 2/4/2026
—Go
GO-2026-5761· CVE-2026-41579, GHSA-xjvp-4fhw-gc47Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc
Modified: 7/8/2026