CVE catalog

CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with a

[CVE catalog]

Severity
Medium · CVSS 4.4CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-containers-storagesid1.64.0-1vulnerable
Debiangolang-github-containers-storageforky1.64.0-1vulnerable
Debiangolang-github-containers-storagetrixie1.57.2+ds1-1vulnerable
Debiangolang-github-containers-storagebookworm1.43.0+ds1-8vulnerable
Ubuntugolang-github-containers-storage20.041.13.2+dfsg1-2vulnerable
Ubuntugolang-github-containers-storage20.041.13.2+dfsg1-3vulnerable
Ubuntugolang-github-containers-storage20.041.13.5+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.1+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.2+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.3+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.5+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.7+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1ubuntu1vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1ubuntu2vulnerable
Ubuntugolang-github-containers-storage20.041.15.8+dfsg1-1ubuntu2.1vulnerable
Ubuntugolang-github-containers-storagepro1.31.3+ds1-1ubuntu1vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2ubuntu0.1vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2ubuntu0.1+esm1vulnerable
Ubuntugolang-github-containers-storagepro1.36.0+ds1-2ubuntu0.1+esm2vulnerable
Ubuntugolang-github-containers-storage24.041.43.0+ds1-8build1vulnerable
Ubuntugolang-github-containers-storage24.041.50.2+ds1-2vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2ubuntu0.24.04.1vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2ubuntu0.24.04.2vulnerable
Ubuntugolang-github-containers-storage24.041.51.0+ds1-2ubuntu0.24.04.3vulnerable
Ubuntugolang-github-containers-storage26.101.61.0+ds1-6vulnerable
Ubuntugolang-github-containers-storage26.101.62.0-3vulnerable
Ubuntugolang-github-containers-storage26.101.63.0-1vulnerable
Ubuntugolang-github-containers-storage26.041.57.2+ds1-1vulnerable
Ubuntugolang-github-containers-storage26.041.61.0+ds1-6vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-containers-storagesourcesid(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-containers-storagesourceforky(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-containers-storagesourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiangolang-github-containers-storagesourcebookworm(unfixed)not yet assignedNot reportedNot reported

Notes

[trixie] golang-github-containers-storage: Minor issue [bookworm] golang-github-containers-storage: Limited support, minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [containers-storage]Affected

    Source package: [golang-github-containers-storage]

    Details (4)

    • 1.43.0+ds1-8+b2 · amd64 · bookworm

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

    • 1.43.0+ds1-8+b2 · arm64 · bookworm

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · amd64 · bookworm-backports

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · arm64 · bookworm-backports

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

  • [golang-github-containers-storage-dev]Affected

    Source package: [golang-github-containers-storage]

    Details (4)

    • 1.43.0+ds1-8 · all · bookworm

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

    • 1.43.0+ds1-8 · all · bookworm

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

    • 1.48.1+ds1-2~bpo12+1 · all · bookworm-backports

      Affected

      nvd · golang-github-containers-storage · debian · bookworm; nvd · golang-github-containers-storage · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]