github.com/opencontainers/runc (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/opencontainers/runc, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (19)

• CVE-2024-21626 — CVSS 8.6 (high): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an…
• CVE-2021-30465 — CVSS 8.5 (high): runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be…
• CVE-2016-3697 — CVSS 7.8 (high): libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username…
• CVE-2025-31133 — CVSS 7.8 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through…
• CVE-2019-16884 — CVSS 7.5 (high): runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because…
• CVE-2025-52881 — CVSS 7.5 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an…
• CVE-2025-52565 — CVSS 7.5 (high): runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1…
• CVE-2023-27561 — CVSS 7.0 (high): runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit…
• CVE-2019-19921 — CVSS 7.0 (high): runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To…
• CVE-2016-9962 — CVSS 6.4 (medium): RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of…
• CVE-2023-28642 — CVSS 6.1 (medium): runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when…
• CVE-2021-43784 — CVSS 6.0 (medium): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as…
• CVE-2025-27612 — CVSS 5.9 (medium): libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts…
• CVE-2022-29162 — CVSS 5.9 (medium): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to…
• CVE-2023-25809 — CVSS 5.0 (medium): runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless…
• CVE-2025-65105 — CVSS 4.5 (medium): Apptainer is an open source container platform. In Apptainer versions less than 1.4.5, a container can disable two of the forms of the…
• CVE-2025-64750 — CVSS 4.5 (medium): SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if…
• CVE-2024-45310 — CVSS 3.6 (low): runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2…
• CVE-2026-41579 — CVSS 3.3 (low): runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1…