GO-2025-4096: github.com/opencontainers/runc fixed in 1.4.0-rc.3, 1.3.3 and 1.2.8

GO-2025-4096 PUBLISHED

Record from OSV · Published November 18, 2025

github.com/opencontainers/runc is fixed in 1.4.0-rc.3, 1.3.3 and 1.2.8 (Go Modules)

Container escape via "masked path" abuse due to mount race conditions in github.com/opencontainers/runc

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/opencontainers/runc	Go Modules	1.4.0-rc.3, 1.3.3, 1.2.8
kubernetes-1.30	Wolfi	1.30.14-r7
eks-distro-fips-1.32	Chainguard	1.32.28-r1
eks-distro-1.32	Chainguard	1.32.28-r1
virt-launcher-1.7	Chainguard	1.7.4-r2
k3s-1.32	Chainguard	1.32.9.1-r2
virt-handler-1.6	Chainguard	1.6.4-r1
node-feature-discovery-fips-0.16	Chainguard	0.16.9-r2
eks-distro-1.30	Chainguard	1.30.46-r1
eks-distro-fips-1.29	Chainguard	1.29.53-r1
k3s-1.33	Chainguard	1.33.5.1-r2
node-feature-discovery-0.18	Chainguard	0.18.3-r1

37 more packages have a fixed version. See every fix in Lookup.

Vendor	Product	Versions
wolfi	kubernetes-1.30	0
chainguard	harvester	*
chainguard	eks-distro-fips-1.32	0
chainguard	eks-distro-1.32	0
chainguard	virt-api-fips-1.8	*
chainguard	virt-launcher-1.7	0
chainguard	k3s-1.32	0
chainguard	docker-machine-driver-harvester	*
chainguard	virt-handler-1.6	0
chainguard	node-feature-discovery-fips-0.16	0
chainguard	eks-distro-1.30	0
chainguard	eks-distro-fips-1.29	0
chainguard	k3s-1.33	0
chainguard	node-feature-discovery-0.18	0
chainguard	azure-container-networking	0
wolfi	buildah	0
chainguard	falco-no-driver	0
chainguard	sriov-network-device-plugin-fips	0
github.com	opencontainers/runc	1.4.0-rc.1, 0, 1.3.0-rc.1
chainguard	virt-handler-fips-1.6	0

…and 39 more

The same record, from the CLI:

vulnetix vdb vuln GO-2025-4096
vulnetix vdb fixes GO-2025-4096

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2025-4096/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart