CVE-2026-53495
published 2026-09-14CVE-2026-53495: containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely…
PriorityP333medium6.8CVSS 4.0
AVLACLATNPRLUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.16%
5.0th percentile
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Affected
224 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| advanced-cluster-security | rhacs-operator-bundle | — | — |
| advanced-cluster-security | rhacs-rhel9-operator | — | — |
| advanced-cluster-security | rhacs-roxctl-rhel9 | — | — |
| advanced-cluster-security | rhacs-scanner-v4-rhel9 | — | — |
| albo | aws-load-balancer-controller-rhel8 | — | — |
| ansible-automation-platform-24 | aap-must-gather-rhel8 | — | — |
| ansible-automation-platform-24 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-24 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-25 | aap-must-gather-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | aap-must-gather-rhel9 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-26 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-27 | aap-must-gather-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-devspaces-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | platform-resource-runner-rhel9 | — | — |
| ansible-automation-platform-tech-preview | ansible-devspaces-rhel9 | — | — |
| assisted | agent-preinstall-image-builder-rhel9 | — | — |
| build-of-trustee | trustee-must-gather-rhel9 | — | — |
| buildah_project | buildah | — | — |
| compliance | openshift-compliance-must-gather-rhel8 | — | — |
| container-native-virtualization | cluster-network-addons-operator | — | — |
CVSS provenance
nvdv4.06.8MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak
vendor_redhat·2026-09-14·CVSS 6.8
CVE-2026-53495 [MEDIUM] CWE-772 github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak
github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime una
GHSA
containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
ghsa·2026-09-09
CVE-2026-53495 [MEDIUM] CWE-400 containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
### Impact
A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd
VulDB
containerd prior 1.7.35/2.0.12/2.2.8/2.3.5 CRI ExecSync execSync resource consumption
vuldb·2026-09-09
CVE-2026-53495 [CRITICAL] containerd prior 1.7.35/2.0.12/2.2.8/2.3.5 CRI ExecSync execSync resource consumption
A vulnerability identified as critical has been detected in containerd. This affects the function execSync of the component CRI ExecSync. Performing a manipulation results in resource consumption.
This vulnerability is known as CVE-2026-53495. Remote exploitation of the attack is possible. No exploit is available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-53495 helm3: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 helm3: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
CVE-2026-53495 helm3: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request
Bugzilla
CVE-2026-53495 trivy: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 trivy: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
CVE-2026-53495 trivy: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request
Bugzilla
CVE-2026-53495 cri-o1.31: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 cri-o1.31: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 cri-o1.31: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 helm: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 helm: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 helm: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the reques
Bugzilla
CVE-2026-53495 tailscale: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 tailscale: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 tailscale: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 cri-o: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 cri-o: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 cri-o: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the reque
Bugzilla
CVE-2026-53495 cri-o1.35: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 cri-o1.35: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 cri-o1.35: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 stargz-snapshotter: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 stargz-snapshotter: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 stargz-snapshotter: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop w
Bugzilla
CVE-2026-53495 helm3: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 helm3: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 helm3: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the reque
Bugzilla
CVE-2026-53495 k9s: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 k9s: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 k9s: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request
Bugzilla
CVE-2026-53495 jfrog-cli: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 jfrog-cli: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 jfrog-cli: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 containerd: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 containerd: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
CVE-2026-53495 containerd: containerd: Denial of Service via CRI ExecSync goroutine leak [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the re
Bugzilla
CVE-2026-53495 cri-o1.34: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 cri-o1.34: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 cri-o1.34: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 cri-o1.36: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 cri-o1.36: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 cri-o1.36: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 inspektor-gadget: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 inspektor-gadget: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 inspektor-gadget: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop whe
Bugzilla
CVE-2026-53495 kata-containers: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 kata-containers: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 kata-containers: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when
Bugzilla
CVE-2026-53495 cri-o1.33: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 cri-o1.33: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 cri-o1.33: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 cri-o1.32: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 cri-o1.32: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 cri-o1.32: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the r
Bugzilla
CVE-2026-53495 doctl: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 doctl: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 doctl: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the reque
Bugzilla
CVE-2026-53495 google-osconfig-agent: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 google-osconfig-agent: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 google-osconfig-agent: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not sto
Bugzilla
CVE-2026-53495 trivy: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 trivy: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 trivy: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the reque
Bugzilla
CVE-2026-53495 containerd: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
bugzilla·2026-09-15·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 containerd: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
CVE-2026-53495 containerd: containerd: Denial of Service via CRI ExecSync goroutine leak [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the
Bugzilla
CVE-2026-53495 github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak
bugzilla·2026-09-14·CVSS 6.8
CVE-2026-53495 [MEDIUM] CVE-2026-53495 github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak
CVE-2026-53495 github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the contai
https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880chttps://github.com/containerd/containerd/commit/5a2a3a759b0d2ad8c821b33c3afc20890daf6d81https://github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaahttps://github.com/containerd/containerd/commit/eebea8c4c912f44b656c8295c9e6607a19b76650https://github.com/containerd/containerd/commit/ff39a972369e2f12fae561a58d658bbf8f2bc318https://github.com/containerd/containerd/releases/tag/v2.0.12https://github.com/containerd/containerd/releases/tag/v2.2.8https://github.com/containerd/containerd/releases/tag/v2.3.5https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv
2026-09-14
Published