CVE-2026-64773: An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. in Apple container

This vulnerability allows an attacker who can reach a container's published TCP port to force the host's forwarding process to buffer an unbounded amount of data from the attacker in memory. The buffering continues for the entire duration that the backend container connection takes to complete, with no caps on the amount of data buffered or the wait time. This can cause denial of service by exhausting host memory resources. The vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling). It affects Apple container software versions >=0 and <1.2.0 and is resolved in version 1.2.0.

The vulnerability can cause a denial of service condition by allowing an attacker to exhaust the host's memory resources through unbounded buffering of client data. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Upgrade Apple container software to version 1.2.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed as an official fix in version 1.2.0.