Chainopencontainers · runcGo:github.com/opencontainers/runc
opencontainers runc: incomplete fixes (2016–2025)
19 CVEs over 8 generations, 31 Jan 2017 to 2 Dec 2025.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2016-996231 Jan 2017 First in the chain
- CVE-2019-573611 Feb 2019 related to CVE-2016-9962
- CVE-2019-1992112 Feb 2020 No direct link to an earlier CVE
- CVE-2020-1429813 Jul 2020 incomplete fix for CVE-2019-5736
- CVE-2020-1430013 Jul 2020 regression of CVE-2016-9962
- CVE-2021-3046527 May 2021 related to CVE-2019-19921
- CVE-2021-437846 Dec 2021 related to CVE-2021-30465related to CVE-2016-9962and 2 more
- CVE-2023-275613 Mar 2023 regression of CVE-2019-19921
- CVE-2023-2580929 Mar 2023 related to CVE-2021-30465
- CVE-2024-2162631 Jan 2024 related to CVE-2016-9962related to CVE-2021-43784and 1 more
- CVE-2024-453103 Sep 2024 next fix after CVE-2024-21626related to CVE-2019-19921and 2 more
- CVE-2025-5486714 Aug 2025 No direct link to an earlier CVE
- CVE-2025-621615 Nov 2025 next fix after CVE-2025-54867
- CVE-2025-625965 Nov 2025 next fix after CVE-2025-54867
- CVE-2025-311336 Nov 2025 next fix after CVE-2024-45310related to CVE-2025-62161
- CVE-2025-525656 Nov 2025 related to CVE-2024-45310related to CVE-2021-30465and 1 more
- CVE-2025-528816 Nov 2025 related to CVE-2019-19921next fix after CVE-2024-45310and 6 more
- CVE-2025-647502 Dec 2025 related to CVE-2019-19921related to CVE-2025-52881
- CVE-2025-651052 Dec 2025 related to CVE-2025-52881related to CVE-2025-64750
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2016-9962 | 31 Jan 2017 | RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container · fixed in 1.0.0-rc3 | First in chain | 7.1 |
| CVE-2019-5736 | 11 Feb 2019 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc… | CVE-2016-9962 · related · Medium | 66.2 |
| CVE-2019-19921 | 12 Feb 2020 | runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to… · fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77 | First in chain | 7.5 |
| CVE-2020-14298 | 13 Jul 2020 | The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an… | CVE-2019-5736 · incomplete fix · High | 5.0 |
| CVE-2020-14300 | 13 Jul 2020 | The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via… | CVE-2016-9962 · regression of · High | 6.4 |
| CVE-2021-30465 | 27 May 2021 | runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal · fixed in 1.0.0-rc95 | CVE-2019-19921 · related · High | 19.1 |
| CVE-2021-43784 | 6 Dec 2021 | Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration · fixed in 1.1.0 | CVE-2021-30465 · related · High | 19.9 |
| CVE-2023-27561 | 3 Mar 2023 | runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to… · fixed in 1.1.5 | CVE-2019-19921 · regression of · High | 12.7 |
| CVE-2023-25809 | 29 Mar 2023 | rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc · fixed in 1.1.5 | CVE-2021-30465 · related · Medium | 8.5 |
| CVE-2024-21626 | 31 Jan 2024 | runc container breakout through process.cwd trickery and leaked fds · fixed in 1.1.12 | CVE-2016-9962 · related · Medium | 67.2 |
| CVE-2024-45310 | 3 Sep 2024 | runc can be confused to create empty files/directories on the host · fixed in 1.2.0-rc.3 | CVE-2024-21626 · Next fix in the same package · High | 7.5 |
| CVE-2025-54867 | 14 Aug 2025 | Youki Symlink Following Vulnerability · fixed in 0.5.5 | First in chain | 6.5 |
| CVE-2025-62161 | 5 Nov 2025 | youki container escape via "masked path" abuse due to mount race conditions · fixed in 0.5.7 | CVE-2025-54867 · Next fix in the same package · Medium | 8.6 |
| CVE-2025-62596 | 5 Nov 2025 | youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects · fixed in 0.5.7 | CVE-2025-54867 · Next fix in the same package · Medium | 8.9 |
| CVE-2025-31133 | 6 Nov 2025 | runc container escape via "masked path" abuse due to mount race conditions · fixed in 1.4.0-rc.3 | CVE-2024-45310 · Next fix in the same package · High | 24.0 |
| CVE-2025-52565 | 6 Nov 2025 | container escape due to /dev/console mount and related races · fixed in 1.4.0-rc.3 | CVE-2024-45310 · related · High | 17.3 |
| CVE-2025-52881 | 6 Nov 2025 | runc: LSM labels can be bypassed with malicious config using dummy procfs files · fixed in 1.4.0-rc.3 | CVE-2019-19921 · related · High | 21.4 |
| CVE-2025-64750 | 2 Dec 2025 | Singluarity ineffectively applies of selinux / apparmor LSM process labels · fixed in 4.3.5 | CVE-2019-19921 · related · High | 4.2 |
| CVE-2025-65105 | 2 Dec 2025 | Apptainer ineffective application of selinux and apparmor --security options · fixed in 1.4.5 | CVE-2025-52881 · related · High | 6.0 |