medium6.9
CVE-2026-53493
Containerd has image-pull DoS via crafted OCI index graph amplification
Impact
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/containerd/containerd/v2 | >= 2.0.0, < 2.0.13 | 2.0.13 |
| go | github.com/containerd/containerd | <= 1.7.35 | 1.7.36 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-pg57-6jwg-q645
- https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645
- https://nvd.nist.gov/vuln/detail/CVE-2026-53493
- https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe
- https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8
- https://github.com/containerd/containerd/releases/tag/v1.7.36
- https://github.com/containerd/containerd/releases/tag/v2.0.13
- https://github.com/containerd/containerd/releases/tag/v2.2.9
- https://github.com/containerd/containerd/releases/tag/v2.3.6
- https://github.com/containerd/containerd/releases/tag/v2.4.1