runc (AlmaLinux:9) — known CVEs & security advisories
Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:9 package runc, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (24)
CVE-2025-68121 — CVSS 10.0 (critical): During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake…
CVE-2024-21626 — CVSS 8.6 (high): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an…
CVE-2025-31133 — CVSS 7.8 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through…
CVE-2022-30632 — CVSS 7.5 (high): Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion…
CVE-2022-41724 — CVSS 7.5 (high): Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers…
CVE-2023-39322 — CVSS 7.5 (high): QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC…
CVE-2022-30630 — CVSS 7.5 (high): Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a…
CVE-2022-30631 — CVSS 7.5 (high): Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2023-45287 — CVSS 7.5 (high): Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent…
CVE-2024-1394 — CVSS 7.5 (high): A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using…
CVE-2025-52565 — CVSS 7.5 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1…
CVE-2025-52881 — CVSS 7.5 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an…
CVE-2025-61726 — CVSS 7.5 (high): The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs…
CVE-2025-61729 — CVSS 7.5 (high): Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out…
CVE-2023-27561 — CVSS 7.0 (high): runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit…
CVE-2019-19921 — CVSS 7.0 (high): runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To…
CVE-2023-28642 — CVSS 6.1 (medium): runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when…
CVE-2021-43784 — CVSS 6.0 (medium): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as…
CVE-2022-29162 — CVSS 5.9 (medium): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to…
CVE-2024-24788 — CVSS 5.9 (medium): A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
CVE-2024-24783 — CVSS 5.9 (medium): Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic…
CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…
CVE-2023-25809 — CVSS 5.0 (medium): runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless…