{"id":"CVE-2026-53493","aliases":["ALPINE-CVE-2026-53493","AZL-104081","AZL-105123","BELL-CVE-2026-53493","DEBIAN-CVE-2026-53493","EUVD-2026-86486","GHSA-pg57-6jwg-q645","GO-2026-6597","OESA-2026-4235","OESA-2026-4236","OESA-2026-4237","OESA-2026-4238","SUSE-SU-2026:24381-1","SUSE-SU-2026:4923-1","UBUNTU-CVE-2026-53493","openSUSE-SU-2026:12127-1"],"status":"published","title":"Containerd has image-pull DoS via crafted OCI index graph amplification","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00356,"percentile":0.29757,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770","CWE-834"],"published":"2026-09-25T00:06:43Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"github.com/containerd/containerd/v2","fixed_in":["2.0.13","2.2.9","2.3.6","2.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/containerd/containerd","fixed_in":["1.7.36"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["2.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"docker","fixed_in":["29.8.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-containerd-cc","fixed_in":["1.7.7-19"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerd2","fixed_in":["2.3.6-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"containerd","fixed_in":["2.4.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"docker","fixed_in":["29.8.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"containerd","fixed_in":["2.1.9+ds1-5"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"containerd","fixed_in":["1.2.0-329.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"containerd","fixed_in":["1.6.22-32.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"containerd","fixed_in":["1.6.22-32.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"containerd","fixed_in":["1.6.22-32.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"elemental","fixed_in":["3.0.4-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.7.35"},{"fixed":"1.7.36"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.2.9"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"last_affected":"2.4.0"},{"fixed":"2.4.1"}]}],"versions":["2.4.0"]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"29.8.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.2-r1"},{"fixed":"2.4.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.2-r0"},{"fixed":"29.8.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.20~ds1-1","1.6.20~ds1-1+deb12u1","1.6.20~ds1-1+deb12u2","1.6.20~ds1-1+deb12u3","1.6.20~ds1-2","1.6.24~ds1-1","1.6.24~ds1-2","1.7.18~ds1-1","1.7.18~ds1-2","1.7.18~ds1-3","1.7.18~ds1-4","1.7.18~ds1-5","1.7.18~ds1-6","1.7.18~ds2-1","1.7.20~ds2-1","1.7.20~ds2-2","1.7.21~ds2-1","1.7.22~ds1-1","1.7.23~ds1-1","1.7.23~ds1-2","1.7.23~ds1-3","1.7.23~ds2-1","1.7.24~ds1-1","1.7.24~ds1-10","1.7.24~ds1-2","1.7.24~ds1-3","1.7.24~ds1-4","1.7.24~ds1-5","1.7.24~ds1-6","1.7.24~ds1-7","1.7.24~ds1-8","1.7.24~ds1-9","2.1.4~ds2-2","2.1.4~ds2-3","2.1.4~ds2-4","2.1.4~ds2-5","2.1.4~ds2-6","2.1.4~ds2-7","2.1.4~ds2-8","2.1.6+ds1-1","2.1.9+ds1-1","2.1.9+ds1-2","2.1.9+ds1-3","2.1.9+ds1-4","2.1.9+ds1-5"]},{"source":"osv","ecosystem":"Debian:13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-10","1.7.24~ds1-6","1.7.24~ds1-6+deb13u1","1.7.24~ds1-7","1.7.24~ds1-8","1.7.24~ds1-9","2.1.4~ds2-2","2.1.4~ds2-3","2.1.4~ds2-4","2.1.4~ds2-5","2.1.4~ds2-6","2.1.4~ds2-7","2.1.4~ds2-8","2.1.6+ds1-1","2.1.9+ds1-1","2.1.9+ds1-2","2.1.9+ds1-3","2.1.9+ds1-4","2.1.9+ds1-5"]},{"source":"osv","ecosystem":"Debian:14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9+ds1-5"}]}],"versions":["1.7.24~ds1-10","1.7.24~ds1-6","1.7.24~ds1-7","1.7.24~ds1-8","1.7.24~ds1-9","2.1.4~ds2-2","2.1.4~ds2-3","2.1.4~ds2-4","2.1.4~ds2-5","2.1.4~ds2-6","2.1.4~ds2-7","2.1.4~ds2-8","2.1.6+ds1-1","2.1.9+ds1-1","2.1.9+ds1-2","2.1.9+ds1-3","2.1.9+ds1-4"]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.36"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"2.2.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.0"},{"fixed":"2.3.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}],"versions":["2.4.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.36"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.13"},{"introduced":"2.1.0"},{"fixed":"2.2.9"},{"introduced":"2.3.0"},{"fixed":"2.3.6"},{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-329.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.22-32.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.22-32.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.22-32.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.29-slfo.1.1_5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.29-16.119.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1","1.2.6-0ubuntu1~16.04.6+esm2","1.2.6-0ubuntu1~16.04.6+esm4","1.2.6-0ubuntu1~16.04.6+esm5","1.2.6-0ubuntu1~16.04.6+esm6","1.2.6-0ubuntu1~16.04.6+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1","1.5.2-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.3","1.5.5-0ubuntu3~18.04.1","1.5.5-0ubuntu3~18.04.2","1.5.9-0ubuntu1~18.04.1","1.5.9-0ubuntu1~18.04.2","1.6.12-0ubuntu1~18.04.1","1.6.12-0ubuntu1~18.04.1+esm1","1.6.12-0ubuntu1~18.04.1+esm2","1.6.12-0ubuntu1~18.04.1+esm3","1.6.12-0ubuntu1~18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2","1.3.3-0ubuntu2.3","1.4.4-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.1","1.5.2-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.3","1.5.5-0ubuntu3~20.04.1","1.5.5-0ubuntu3~20.04.2","1.5.9-0ubuntu1~20.04.1","1.5.9-0ubuntu1~20.04.4","1.5.9-0ubuntu1~20.04.5","1.5.9-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.1","1.6.12-0ubuntu1~20.04.3","1.6.12-0ubuntu1~20.04.5","1.6.12-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.7","1.6.12-0ubuntu1~20.04.8","1.6.12-0ubuntu1~20.04.8+esm1","1.6.12-0ubuntu1~20.04.8+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-0ubuntu1~20.04.1","1.7.12-0ubuntu2~20.04.1","1.7.24-0ubuntu1~20.04.1","1.7.24-0ubuntu1~20.04.2","1.7.24-0ubuntu1~20.04.2+esm1","1.7.24-0ubuntu1~20.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.5-0ubuntu3","1.5.9-0ubuntu1","1.5.9-0ubuntu2","1.5.9-0ubuntu3","1.5.9-0ubuntu3.1","1.6.12-0ubuntu1~22.04.1","1.6.12-0ubuntu1~22.04.3","1.6.12-0ubuntu1~22.04.5","1.6.12-0ubuntu1~22.04.6","1.6.12-0ubuntu1~22.04.7","1.6.12-0ubuntu1~22.04.8","1.6.12-0ubuntu1~22.04.9","1.6.12-0ubuntu1~22.04.10","1.6.12-0ubuntu1~22.04.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-0ubuntu1~22.04.1","1.7.12-0ubuntu2~22.04.1","1.7.24-0ubuntu1~22.04.1","1.7.24-0ubuntu1~22.04.2","1.7.27-0ubuntu1~22.04.1","1.7.28-0ubuntu1~22.04.1","1.7.28-0ubuntu1~22.04.1+esm1","2.2.1-0ubuntu1~22.04.1","2.2.1-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-0ubuntu2","1.7.12-0ubuntu1","1.7.12-0ubuntu2","1.7.12-0ubuntu3","1.7.12-0ubuntu4","1.7.12-0ubuntu4.1","1.7.19-0ubuntu1~24.04.1","1.7.19+really1.7.12-0ubuntu4.2","1.7.24-0ubuntu1~24.04.1","1.7.24-0ubuntu1~24.04.2","1.7.27-0ubuntu1~24.04.1","1.7.28-0ubuntu1~24.04.1","1.7.28-0ubuntu1~24.04.2","2.2.1-0ubuntu1~24.04.2","2.2.1-0ubuntu1~24.04.3","2.2.1-0ubuntu1~24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.20~ds1-1ubuntu2","1.6.24~ds1-1ubuntu1","1.6.24~ds1-1ubuntu1.1","1.6.24~ds1-1ubuntu1.2","1.6.24~ds1-1ubuntu1.2+esm1","1.6.24~ds1-1ubuntu1.3","1.6.24~ds1-1ubuntu1.3+esm1","1.6.24~ds1-1ubuntu1.3+esm2","1.6.24~ds1-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-10ubuntu1","2.1.9+ds1-2ubuntu1","2.1.9+ds1-3ubuntu1","2.1.9+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-0ubuntu1","2.2.2-0ubuntu2","2.3.4+dfsg1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"containerd-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-0ubuntu1","2.2.2-0ubuntu2","2.3.4+dfsg1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.3-0ubuntu3","2.2.1-0ubuntu1","2.2.2-0ubuntu1","2.2.2-0ubuntu1.1","2.2.2-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"containerd-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.3-0ubuntu1","2.1.5-0ubuntu1","2.2.1-0ubuntu1","2.2.2-0ubuntu1","2.2.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-8ubuntu1","1.7.24~ds1-10ubuntu1","1.7.24~ds1-10ubuntu1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"elemental","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4-1.1"}]}]}],"products":[{"vendor":"containerd","product":"containerd"}],"references":[{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53493","tags":["web","advisory"]},{"url":"https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe","tags":["web","fix"]},{"url":"https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8","tags":["web","fix"]},{"url":"https://github.com/containerd/containerd/releases/tag/v1.7.36","tags":["web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v2.0.13","tags":["web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v2.2.9","tags":["web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v2.3.6","tags":["web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v2.4.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pg57-6jwg-q645"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-53493","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-53493","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53493.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53493","tags":["advisory"]},{"url":"https://github.com/containerd/containerd","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4235","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4236","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4237","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4238","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624381-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268430","tags":["report"]},{"url":"https://bugzilla.suse.com/1268441","tags":["report"]},{"url":"https://bugzilla.suse.com/1274214","tags":["report"]},{"url":"https://bugzilla.suse.com/1280007","tags":["report"]},{"url":"https://bugzilla.suse.com/1282669","tags":["report"]},{"url":"https://bugzilla.suse.com/1285124","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95838","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264923-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-53493","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53493","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-53493","title":"Containerd has image-pull DoS via crafted OCI index graph amplification","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T00:06:43.298Z","modified":"2026-09-28T14:58:33.011Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-770","CWE-834"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-86486","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T00:06:43Z","modified":"2026-09-28T14:58:33Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:53.425914Z"}],"ghsa":[{"id":"GHSA-pg57-6jwg-q645","title":"Containerd has image-pull DoS via crafted OCI index graph amplification","description":"### Impact\n\nA vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the `PullImage` operation, the recursive traversal and processing of child descriptors lack sufficient depth and breadth limits, and fail to adequately deduplicate identical descriptors. This unbounded traversal leads to excessive resource allocation.\n\nConsequently, pulling a malicious image reference can result in prolonged stalls during container creation and significant resource pressure on the host system. This issue occurs entirely during the image pull phase, prior to any container execution.\n\n### Patches\n\nThis bug has been fixed in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nThere are no known workarounds for this issue. Users are advised to only pull trusted images from known registries until the patch can be applied.\n\n### Credits\n\nThe containerd project would like to thank Jakub Ciolek at ElevenLabs and @jlgore who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2026-09-25T19:27:59Z","modified":"2026-09-25T19:28:01Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770","CWE-834"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2026-53493","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T01:16:48.227Z","modified":"2026-09-28T15:17:17.9Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-770","CWE-834"],"updated_at":"2026-11-02T14:12:51.388161Z"}],"osv":[{"id":"ALPINE-CVE-2026-53493","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T01:16:48.227Z","modified":"2026-11-03T06:33:03.89419045Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-53493","title":"Containerd has image-pull DoS via crafted OCI index graph amplification","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T00:06:43.298Z","modified":"2026-10-28T12:11:55.820853705Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770","CWE-834"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-53493","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T01:16:48.227Z","modified":"2026-10-10T11:00:09.722564905Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-pg57-6jwg-q645","title":"Containerd has image-pull DoS via crafted OCI index graph amplification","description":"### Impact\n\nA vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the `PullImage` operation, the recursive traversal and processing of child descriptors lack sufficient depth and breadth limits, and fail to adequately deduplicate identical descriptors. This unbounded traversal leads to excessive resource allocation.\n\nConsequently, pulling a malicious image reference can result in prolonged stalls during container creation and significant resource pressure on the host system. This issue occurs entirely during the image pull phase, prior to any container execution.\n\n### Patches\n\nThis bug has been fixed in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nThere are no known workarounds for this issue. Users are advised to only pull trusted images from known registries until the patch can be applied.\n\n### Credits\n\nThe containerd project would like to thank Jakub Ciolek at ElevenLabs and @jlgore who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2026-09-25T19:27:59Z","modified":"2026-10-01T20:55:46.094271282Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770","CWE-834"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"OESA-2026-4235","title":"containerd security update","description":"containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability.  It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.\r\n\r\nSecurity Fix(es):\n\ncontainerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.(CVE-2026-53493)","status":"published","published":"2026-10-16T11:58:27Z","modified":"2026-10-16T12:15:04.301675794Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4236","title":"containerd security update","description":"containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability.  It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.\r\n\r\nSecurity Fix(es):\n\ncontainerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.(CVE-2026-53493)","status":"published","published":"2026-10-16T11:58:28Z","modified":"2026-10-16T12:15:03.289725697Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4237","title":"containerd security update","description":"containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability.  It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.\r\n\r\nSecurity Fix(es):\n\ncontainerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.(CVE-2026-53493)","status":"published","published":"2026-10-16T11:58:28Z","modified":"2026-10-16T12:15:04.299723304Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4238","title":"containerd security update","description":"containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability.  It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision, low-level storage and network attachments, etc.\r\n\r\nSecurity Fix(es):\n\ncontainerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.(CVE-2026-53493)","status":"published","published":"2026-10-16T11:58:28Z","modified":"2026-10-16T12:15:05.209372268Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-53493","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T01:16:00Z","modified":"2026-10-22T16:15:28.48645968Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-104081","title":"CVE-2026-53493 affecting package moby-containerd-cc for versions less than 1.7.7-19","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T01:16:48Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.528763Z"},{"id":"AZL-105123","title":"CVE-2026-53493 affecting package containerd2 for versions less than 2.3.6-1","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","status":"published","published":"2026-09-25T01:16:48Z","modified":"2026-11-02T14:17:22.118976868Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"BELL-CVE-2026-53493","status":"published","published":"2026-09-29T06:08:06.99453Z","modified":"2026-10-08T07:15:05.482090799Z","updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"GO-2026-6597","title":"Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd","description":"Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd","status":"published","published":"2026-10-01T20:23:38Z","modified":"2026-10-01T20:45:17.223140621Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:12127-1","title":"elemental3-3.0.4-1.1 on GA media","description":"These are all security issues fixed in the elemental3-3.0.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-14T00:00:00Z","modified":"2026-10-15T17:23:12.031902753Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:24381-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP\n  response body reading (bsc#1274214).\n- CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).\n- CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation (bsc#1268430).\n- CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container\n  start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282669).\n- CVE-2026-53495: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280007).\n- CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time\n  complexity in unpack handler and can lead to DoS (bsc#1285124).\n","status":"published","published":"2026-10-23T08:05:50Z","modified":"2026-10-27T17:23:19.484667937Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4923-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP\n  response body reading (bsc#1274214).\n- CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).\n- CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container\n  start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282669).\n- CVE-2026-53495: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280007).\n- CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time\n  complexity in unpack handler and can lead to DoS (bsc#1285124).\n","status":"published","published":"2026-10-27T17:09:41Z","modified":"2026-10-28T12:00:03.997491904Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}