CVE-2026-64773 Denial of service in container
Attackers can exhaust host memory via unbounded buffering in Apple's container runtime, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64773?
CVE-2026-64773 is a high-severity denial of service vulnerability in Apple container, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-64773?
It affects 1 product.
Products include Apple Container.
How do I fix CVE-2026-64773?
No fix has been published for CVE-2026-64773 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-64773 being exploited?
There is no known exploitation of CVE-2026-64773 in the wild and no public exploit code.
Other vulnerabilities in Apple container
- CVE-2026-20613 Container and Containerization archive extraction does not guard against escapes from extraction base directory.
- CVE-2026-28909 Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext.
- CVE-2026-64777 Path traversal in container
Sources
Also known as GHSA-wg28-286f-56v6.