CVE-2026-53493 · GHSA-pg57-6jwg-q645
Containerd has image-pull DoS via crafted OCI index graph amplification
- Risk score
- 57/100
- CVSS
- 6.9 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0…
- Affected
- github.com/containerd/containerd/v2 (go) >= 2.0.0, < 2.0.13; github.com/containerd/containerd (go) <= 1.7.35; github.com/containerd/containerd/v2 (go) >= 2.1.0, < 2.2.9; github.com/containerd/containerd/v2 (go) >= 2.3.0, < 2.3.6
- Fix
- Upgrade github.com/containerd/containerd/v2 to 2.0.13 or 2.2.9 or 2.3.6 or 2.4.1; github.com/containerd/containerd to 1.7.36 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
github.com/containerd/containerd/v2: Yellow, plan it in. containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0…
The flaws
- CVE-2026-53493: Containerd has image-pull DoS via crafted OCI index graph amplification (CVSS 6.9 · EPSS 0%)
- CVE-2026-95837: Containerd CRI plugin: Checkpoint restore bypasses destination security context (CVSS 7.8 · EPSS 0%)
- CVE-2026-95838: Containerd: Unpack DoS via repeated opaque whiteouts (CVSS 4.6 · EPSS 0%)
The fix
Upgrade github.com/containerd/containerd/v2: 1.7.36 · 2.0.13 · 2.2.9 · 2.3.6 · 2.4.1 · 2.2.7 or later on your release line
Who is exposed: github.com/containerd/containerd/v2 (go) >= 2.0.0, < 2.0.13; github.com/containerd/containerd (go) <= 1.7.35; github.com/containerd/containerd/v2 (go) >= 2.1.0, < 2.2.9; github.com/containerd/containerd/v2 (go) >= 2.3.0, < 2.3.6
Where it stands
- No known exploitation
Connects to
- Same weakness: Denial of service (CWE-400). 256 other warnings in 30 days
Why it is Yellow
- CVSS 6.9 medium
- On your watchlist: containerd, Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/containerd/containerd/v2 | go | >= 2.0.0, < 2.0.13 | 2.0.13 |
| github.com/containerd/containerd | go | <= 1.7.35 | 1.7.36 |
| github.com/containerd/containerd/v2 | go | >= 2.1.0, < 2.2.9 | 2.2.9 |
| github.com/containerd/containerd/v2 | go | >= 2.3.0, < 2.3.6 | 2.3.6 |
| github.com/containerd/containerd/v2 | go | = 2.4.0 | 2.4.1 |
References
- https://github.com/advisories/GHSA-pg57-6jwg-q645
- https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645
- https://nvd.nist.gov/vuln/detail/CVE-2026-53493
- https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe
- https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8
- https://github.com/containerd/containerd/releases/tag/v1.7.36
- https://github.com/containerd/containerd/releases/tag/v2.0.13
- https://github.com/containerd/containerd/releases/tag/v2.2.9
- https://github.com/containerd/containerd/releases/tag/v2.3.6
- https://github.com/containerd/containerd/releases/tag/v2.4.1
Original description
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
Last activity 25 Sep 2026. Patch Forecast updates every hour.