CVE-2026-53493
published 2026-09-25CVE-2026-53493: containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high…
PriorityP337medium6.9CVSS 4.0
AVNACLATNPRNUINVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.36%
28.1th percentile
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| containerd | containerd | < 1.7.36 | 1.7.36 |
| containerd | containerd | — | — |
| containerd | containerd | — | — |
| containerd | containerd | — | — |
| containerd | containerd | — | — |
| github.com | containerd_containerd | >= 0 < 1.7.36 | 1.7.36 |
| github.com | containerd_containerd_v2 | >= 2.0.0 < 2.0.13 | 2.0.13 |
| github.com | containerd_containerd_v2 | >= 2.1.0 < 2.2.9 | 2.2.9 |
| github.com | containerd_containerd_v2 | >= 2.3.0 < 2.3.6 | 2.3.6 |
| github.com | containerd_containerd_v2 | >= 2.4.0 < 2.4.1 | 2.4.1 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Containerd has image-pull DoS via crafted OCI index graph amplification
ghsa·2026-09-25
CVE-2026-53493 [MEDIUM] CWE-400 Containerd has image-pull DoS via crafted OCI index graph amplification
Containerd has image-pull DoS via crafted OCI index graph amplification
### Impact
A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the `PullImage` operation, the recursive traversal and processing of child descriptors lack sufficient depth and breadth limits, and fail to adequately deduplicate identical descriptors. This unbounded traversal leads to excessive resource allocation.
Consequently, pulling a malicious image reference can result in prolonged stalls during container creation and significant resource pressure on the host system. This issue occurs entirely during the image pull phase, prior to any container execution.
VulDB
containerd up to 2.4.0 OCI Index Graph resource consumption
vuldb·2026-09-25·CVSS 6.9
CVE-2026-53493 [MEDIUM] containerd up to 2.4.0 OCI Index Graph resource consumption
A vulnerability described as critical has been identified in containerd up to 1.7.35/2.0.12/2.2.8/2.3.5/2.4.0. This issue affects some unknown processing of the component OCI Index Graph. Such manipulation leads to resource consumption.
This vulnerability is referenced as CVE-2026-53493. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
Red Hat
github.com/containerd/containerd: containerd: Denial of Service via crafted OCI image index
vendor_redhat·2026-09-25·CVSS 6.9
CVE-2026-53493 [MEDIUM] CWE-770 github.com/containerd/containerd: containerd: Denial of Service via crafted OCI image index
github.com/containerd/containerd: containerd: Denial of Service via crafted OCI image index
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
A flaw was found in containerd. During an image pull operation, containerd fails to enforce recursion and deduplication limits when traversing descriptor graphs in Open Container Initiative (OCI) image indexes. A remote attacker can exploit this flaw by serving a crafted image index, triggering excessive CPU and memory consumption. This issu
No detection rules found.
No public exploits indexed.
2026-09-25
Published