Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
containerd may accept improperly validated wildcard certificates
published 1 month ago
Summary
The containerd software can incorrectly check certain DNS rules when it looks at certificates that contain wildcard entries written in a different letter case. This mistake could let a fake or altered certificate be accepted, potentially exposing services to tampering. Update containerd to the latest version or apply the vendor's recommended patch to fix the validation logic.
What to do
- Update cleanstart containerd to version 2.1.3-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | containerd |
< 2.1.3-r2 Fix: upgrade to 2.1.3-r2
|
Original advisory text
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint
Security vulnerability affects the containerd package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published30 Sep 2026
Updated1 Oct 2026
First seen1 Oct 2026
Sources
CLEANSTART-2026-GW80468 · OSV
Track software like this
Free during beta