[ CVE-2026-113957 · Published 29 Oct 2026 ]
Vulnerability in Apple container
CVSS 5.6
EPSS <1%No fix listed yet
[ Description ]Official description
An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.