Containerd's layer unpack handler can become trapped in repeated directory traversals when processing certain opaque whiteout configurations within a malicious image layer. The result is uncontrolled CPU consumption, causing the host to experience delays in container startup, degraded image pull performance, and reduced concurrency for unrelated deployments. The weakness is an uncontrolled resource consumption flaw (CWE-400) compounded by excessive resource use (CWE-407) and, based on the description, it is inferred that opaque whiteout metadata may not be properly validated (CWE-606).

The issue affects the containerd open‑source container runtime. Versions earlier than 1.7.35, 2.0.12, 2.2.8, and 2.3.5 are vulnerable. All builds for the containerd:containerd product are impacted when operating with these versions.

The CVSS score of 4.6 indicates a moderate severity. The EPSS score of 0.00215 (less than 1%) suggests a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is through pulling or importing a malicious image that contains the offending layer; the vulnerability is triggered during the unpack stage, which is performed by the containerd runtime. An attacker with the ability to supply untrusted images to a containerd host can trigger the DoS, consuming host resources and preventing timely startup of other containers.