Patchfirst
Patchfirst
Chainopencontainers · runcGo:github.com/opencontainers/runc

opencontainers runc: incomplete fixes (2016–2025)

19 CVEs over 6 generations, 31 Jan 2017 to 2 Dec 2025.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2016-996231 Jan 2017 First in the chain
  2. CVE-2019-573611 Feb 2019 related to CVE-2016-9962
  3. CVE-2019-1992112 Feb 2020 No direct link to an earlier CVE
  4. CVE-2020-1429813 Jul 2020 incomplete fix for CVE-2019-5736
  5. CVE-2020-1430013 Jul 2020 regression of CVE-2016-9962
  6. CVE-2021-3046527 May 2021 related to CVE-2019-19921
  7. CVE-2021-437846 Dec 2021 related to CVE-2021-30465related to CVE-2016-9962and 2 more
  8. CVE-2023-275613 Mar 2023 regression of CVE-2019-19921
  9. CVE-2023-2580929 Mar 2023 related to CVE-2021-30465
  10. CVE-2024-2162631 Jan 2024 related to CVE-2016-9962related to CVE-2021-43784and 1 more
  11. CVE-2024-453103 Sep 2024 related to CVE-2024-21626related to CVE-2019-19921and 2 more
  12. CVE-2025-5486714 Aug 2025 No direct link to an earlier CVE
  13. CVE-2025-621615 Nov 2025 next fix after CVE-2025-54867
  14. CVE-2025-625965 Nov 2025 next fix after CVE-2025-54867
  15. CVE-2025-311336 Nov 2025 related to CVE-2025-62161next fix after CVE-2024-45310
  16. CVE-2025-525656 Nov 2025 next fix after CVE-2024-45310related to CVE-2025-31133
  17. CVE-2025-528816 Nov 2025 related to CVE-2019-19921related to CVE-2025-62596and 3 more
  18. CVE-2025-647502 Dec 2025 related to CVE-2019-19921related to CVE-2025-52881
  19. CVE-2025-651052 Dec 2025 related to CVE-2025-52881related to CVE-2025-64750
201720182019202020212022202320242025 CVE-2016-9962 → CVE-2020-14300: regression of (high confidence)CVE-2019-5736 → CVE-2020-14298: incomplete fix (high confidence)CVE-2019-19921 → CVE-2021-30465: related (high confidence)CVE-2019-19921 → CVE-2023-27561: regression of (high confidence)CVE-2019-19921 → CVE-2025-52881: related (high confidence)CVE-2019-19921 → CVE-2025-64750: related (high confidence)CVE-2021-30465 → CVE-2021-43784: related (high confidence)CVE-2024-21626 → CVE-2024-45310: related (high confidence)CVE-2025-62161 → CVE-2025-31133: related (high confidence)CVE-2025-62596 → CVE-2025-52881: related (high confidence)CVE-2025-31133 → CVE-2025-52881: related (high confidence)CVE-2025-52565 → CVE-2025-52881: related (high confidence)CVE-2025-52881 → CVE-2025-64750: related (high confidence)CVE-2025-52881 → CVE-2025-65105: related (high confidence)CVE-2025-64750 → CVE-2025-65105: related (high confidence)CVE-2016-9962 → CVE-2019-5736: related (medium confidence)CVE-2016-9962 → CVE-2021-43784: related (medium confidence)CVE-2016-9962 → CVE-2024-21626: related (medium confidence)CVE-2019-5736 → CVE-2021-43784: related (medium confidence)CVE-2019-19921 → CVE-2021-43784: related (medium confidence)CVE-2019-19921 → CVE-2024-45310: related (medium confidence)CVE-2021-30465 → CVE-2023-25809: related (medium confidence)CVE-2021-30465 → CVE-2024-45310: related (medium confidence)CVE-2021-43784 → CVE-2024-21626: related (medium confidence)CVE-2021-43784 → CVE-2024-45310: related (medium confidence)CVE-2025-54867 → CVE-2025-62161: Next fix in the same package (medium confidence)CVE-2025-54867 → CVE-2025-62596: Next fix in the same package (medium confidence)CVE-2023-25809 → CVE-2024-21626: Next fix in the same package (low confidence)CVE-2024-45310 → CVE-2025-31133: Next fix in the same package (low confidence)CVE-2024-45310 → CVE-2025-52565: Next fix in the same package (low confidence)CVE-2024-45310 → CVE-2025-52881: Next fix in the same package (low confidence)CVE-2025-31133 → CVE-2025-52565: related (low confidence) CVE-2016-9962 31 Jan 2017 CVE-2019-5736 11 Feb 2019 CVE-2019-19921 12 Feb 2020 CVE-2020-14298 13 Jul 2020 CVE-2020-14300 13 Jul 2020 CVE-2021-30465 27 May 2021 CVE-2021-43784 6 Dec 2021 CVE-2023-27561 3 Mar 2023 CVE-2023-25809 29 Mar 2023 CVE-2024-21626 31 Jan 2024 CVE-2024-45310 3 Sep 2024 CVE-2025-54867 14 Aug 2025 CVE-2025-62161 5 Nov 2025 CVE-2025-62596 5 Nov 2025 CVE-2025-31133 6 Nov 2025 CVE-2025-52565 6 Nov 2025 CVE-2025-52881 6 Nov 2025 CVE-2025-64750 2 Dec 2025 CVE-2025-65105 2 Dec 2025 201720182019202020212022202320242025 CVE-2016-9962 → CVE-2020-14300: regression of (high confidence)CVE-2019-5736 → CVE-2020-14298: incomplete fix (high confidence)CVE-2019-19921 → CVE-2021-30465: related (high confidence)CVE-2019-19921 → CVE-2023-27561: regression of (high confidence)CVE-2019-19921 → CVE-2025-52881: related (high confidence)CVE-2019-19921 → CVE-2025-64750: related (high confidence)CVE-2021-30465 → CVE-2021-43784: related (high confidence)CVE-2024-21626 → CVE-2024-45310: related (high confidence)CVE-2025-62161 → CVE-2025-31133: related (high confidence)CVE-2025-62596 → CVE-2025-52881: related (high confidence)CVE-2025-31133 → CVE-2025-52881: related (high confidence)CVE-2025-52565 → CVE-2025-52881: related (high confidence)CVE-2025-52881 → CVE-2025-64750: related (high confidence)CVE-2025-52881 → CVE-2025-65105: related (high confidence)CVE-2025-64750 → CVE-2025-65105: related (high confidence)CVE-2016-9962 → CVE-2019-5736: related (medium confidence)CVE-2016-9962 → CVE-2021-43784: related (medium confidence)CVE-2016-9962 → CVE-2024-21626: related (medium confidence)CVE-2019-5736 → CVE-2021-43784: related (medium confidence)CVE-2019-19921 → CVE-2021-43784: related (medium confidence)CVE-2019-19921 → CVE-2024-45310: related (medium confidence)CVE-2021-30465 → CVE-2023-25809: related (medium confidence)CVE-2021-30465 → CVE-2024-45310: related (medium confidence)CVE-2021-43784 → CVE-2024-21626: related (medium confidence)CVE-2021-43784 → CVE-2024-45310: related (medium confidence)CVE-2025-54867 → CVE-2025-62161: Next fix in the same package (medium confidence)CVE-2025-54867 → CVE-2025-62596: Next fix in the same package (medium confidence)CVE-2023-25809 → CVE-2024-21626: Next fix in the same package (low confidence)CVE-2024-45310 → CVE-2025-31133: Next fix in the same package (low confidence)CVE-2024-45310 → CVE-2025-52565: Next fix in the same package (low confidence)CVE-2024-45310 → CVE-2025-52881: Next fix in the same package (low confidence)CVE-2025-31133 → CVE-2025-52565: related (low confidence) CVE-2016-9962 31 Jan 2017 CVE-2019-5736 11 Feb 2019 CVE-2019-19921 12 Feb 2020 CVE-2020-14298 13 Jul 2020 CVE-2020-14300 13 Jul 2020 CVE-2021-30465 27 May 2021 CVE-2021-43784 6 Dec 2021 CVE-2023-27561 3 Mar 2023 CVE-2023-25809 29 Mar 2023 CVE-2024-21626 31 Jan 2024 CVE-2024-45310 3 Sep 2024 CVE-2025-54867 14 Aug 2025 CVE-2025-62161 5 Nov 2025 CVE-2025-62596 5 Nov 2025 CVE-2025-31133 6 Nov 2025 CVE-2025-52565 6 Nov 2025 CVE-2025-52881 6 Nov 2025 CVE-2025-64750 2 Dec 2025 CVE-2025-65105 2 Dec 2025
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2016-9962 31 Jan 2017 RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container · fixed in 1.0.0-rc3 First in chain 7.1
CVE-2019-5736 11 Feb 2019 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc… CVE-2016-9962 · related · Medium 66.2
CVE-2019-19921 12 Feb 2020 runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to… · fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77 First in chain 7.5
CVE-2020-14298 13 Jul 2020 The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an… CVE-2019-5736 · incomplete fix · High 5.0
CVE-2020-14300 13 Jul 2020 The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via… CVE-2016-9962 · regression of · High 6.4
CVE-2021-30465 27 May 2021 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal · fixed in 1.0.0-rc95 CVE-2019-19921 · related · High 19.1
CVE-2021-43784 6 Dec 2021 Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration · fixed in 1.1.0 CVE-2021-30465 · related · High 19.9
CVE-2023-27561 3 Mar 2023 runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to… · fixed in 1.1.5 CVE-2019-19921 · regression of · High 12.7
CVE-2023-25809 29 Mar 2023 rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc · fixed in 1.1.5 CVE-2021-30465 · related · Medium 8.5
CVE-2024-21626 31 Jan 2024 runc container breakout through process.cwd trickery and leaked fds · fixed in 1.1.12 CVE-2016-9962 · related · Medium 67.2
CVE-2024-45310 3 Sep 2024 runc can be confused to create empty files/directories on the host · fixed in 1.2.0-rc.3 CVE-2024-21626 · related · High 7.5
CVE-2025-54867 14 Aug 2025 Youki Symlink Following Vulnerability · fixed in 0.5.5 First in chain 6.5
CVE-2025-62161 5 Nov 2025 youki container escape via "masked path" abuse due to mount race conditions · fixed in 0.5.7 CVE-2025-54867 · Next fix in the same package · Medium 8.6
CVE-2025-62596 5 Nov 2025 youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects · fixed in 0.5.7 CVE-2025-54867 · Next fix in the same package · Medium 8.9
CVE-2025-31133 6 Nov 2025 runc container escape via "masked path" abuse due to mount race conditions · fixed in 1.4.0-rc.3 CVE-2025-62161 · related · High 24.0
CVE-2025-52565 6 Nov 2025 container escape due to /dev/console mount and related races · fixed in 1.4.0-rc.3 CVE-2024-45310 · Next fix in the same package · Low 17.3
CVE-2025-52881 6 Nov 2025 runc: LSM labels can be bypassed with malicious config using dummy procfs files · fixed in 1.4.0-rc.3 CVE-2019-19921 · related · High 21.4
CVE-2025-64750 2 Dec 2025 Singluarity ineffectively applies of selinux / apparmor LSM process labels · fixed in 4.3.5 CVE-2019-19921 · related · High 4.2
CVE-2025-65105 2 Dec 2025 Apptainer ineffective application of selinux and apparmor --security options · fixed in 1.4.5 CVE-2025-52881 · related · High 6.0
↑ ↓ chooseEnter openEsc close