Hotdog Container Escape
Priority LOW 38CWE-250Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250.
Summary
Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or syscall filters of the target JVM process. This would allow a container to exhaust the resources of the host, modify devices, or make syscalls that would otherwise be blocked.
Why it matters now
EPSS 0.00391 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Hotdog (Amazon Web Services): 1.0.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AWS | Hotdog | before 1.0.2 | 1.0.2 | Patch available | CNA |
- Hotdog VendorAWS Affected before 1.0.2 Fixed in 1.0.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hotdog_project:hotdog:*:*:*:*:*:java:*:* | before 1.0.2 | Vulnerable | Hotdog Project |
- cpe:2.3:a:hotdog_project:hotdog:*:*:*:*:*:java:*:* Versions before 1.0.2 Vulnerable ·Hotdog Project
Remediation
- Fix · CNA Hotdog (Amazon Web Services) Fixed in 1.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0071
References
More AWS vulnerabilities
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
- TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences