Mitigating High Severity RunC Vulnerability (CVE-2019-5736)

A new high-severity container escape (CVE-2019-5736) in runc allows a malicious container running as root to overwrite the host runc binary and gain root-level code execution on the host. The report details impact, vendor patches, and mitigations—Aqua recommends patching hosts and applying runtime protections such as blocking runc processes, preventing untrusted or root containers, enforcing user namespaces, and using host vulnerability scans.