{"id":"CVE-2026-53495","aliases":["ALPINE-CVE-2026-53495","AZL-100986","AZL-101004","BELL-CVE-2026-53495","DEBIAN-CVE-2026-53495","EUVD-2026-77684","GHSA-7jxh-36q5-gcqv","GO-2026-6444","SUSE-SU-2026:23855-1","SUSE-SU-2026:23863-1","SUSE-SU-2026:24381-1","SUSE-SU-2026:4923-1","UBUNTU-CVE-2026-53495","openSUSE-SU-2026:11766-1","openSUSE-SU-2026:11977-1","openSUSE-SU-2026:12342-1","openSUSE-SU-2026:21835-1","openSUSE-SU-2026:21897-1","openSUSE-SU-2026:22116-1"],"status":"published","title":"containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00162,"percentile":0.05407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-09-08T20:25:23.270863Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"github.com/containerd/containerd/v2","fixed_in":["2.0.12","2.2.8","2.3.5"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/containerd/containerd","fixed_in":["1.7.35"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["2.3.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-containerd-cc","fixed_in":["1.7.7-19"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerd2","fixed_in":["2.3.7-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"containerd","fixed_in":["1.7.35-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"containerd","fixed_in":["2.2.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"containerd","fixed_in":["2.3.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"containerd","fixed_in":["2.1.9+ds1-4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hauler","fixed_in":["2.1.0-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"trivy","fixed_in":["0.75.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.12"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.35"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.5-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-containerd-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.10-r0"},{"fixed":"1.7.35-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1-r0"},{"fixed":"2.2.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.2-r1"},{"fixed":"2.3.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.20~ds1-1","1.6.20~ds1-1+deb12u1","1.6.20~ds1-1+deb12u2","1.6.20~ds1-1+deb12u3","1.6.20~ds1-2","1.6.24~ds1-1","1.6.24~ds1-2","1.7.18~ds1-1","1.7.18~ds1-2","1.7.18~ds1-3","1.7.18~ds1-4","1.7.18~ds1-5","1.7.18~ds1-6","1.7.18~ds2-1","1.7.20~ds2-1","1.7.20~ds2-2","1.7.21~ds2-1","1.7.22~ds1-1","1.7.23~ds1-1","1.7.23~ds1-2","1.7.23~ds1-3","1.7.23~ds2-1","1.7.24~ds1-1","1.7.24~ds1-10","1.7.24~ds1-2","1.7.24~ds1-3","1.7.24~ds1-4","1.7.24~ds1-5","1.7.24~ds1-6","1.7.24~ds1-7","1.7.24~ds1-8","1.7.24~ds1-9","2.1.4~ds2-2","2.1.4~ds2-3","2.1.4~ds2-4","2.1.4~ds2-5","2.1.4~ds2-6","2.1.4~ds2-7","2.1.4~ds2-8","2.1.6+ds1-1","2.1.9+ds1-1","2.1.9+ds1-2","2.1.9+ds1-3","2.1.9+ds1-4","2.1.9+ds1-5"]},{"source":"osv","ecosystem":"Debian:13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-10","1.7.24~ds1-6","1.7.24~ds1-6+deb13u1","1.7.24~ds1-7","1.7.24~ds1-8","1.7.24~ds1-9","2.1.4~ds2-2","2.1.4~ds2-3","2.1.4~ds2-4","2.1.4~ds2-5","2.1.4~ds2-6","2.1.4~ds2-7","2.1.4~ds2-8","2.1.6+ds1-1","2.1.9+ds1-1","2.1.9+ds1-2","2.1.9+ds1-3","2.1.9+ds1-4","2.1.9+ds1-5"]},{"source":"osv","ecosystem":"Debian:14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9+ds1-4"}]}],"versions":["1.7.24~ds1-10","1.7.24~ds1-6","1.7.24~ds1-7","1.7.24~ds1-8","1.7.24~ds1-9","2.1.4~ds2-2","2.1.4~ds2-3","2.1.4~ds2-4","2.1.4~ds2-5","2.1.4~ds2-6","2.1.4~ds2-7","2.1.4~ds2-8","2.1.6+ds1-1","2.1.9+ds1-1","2.1.9+ds1-2","2.1.9+ds1-3"]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.12"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.35"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.0"},{"fixed":"2.3.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.35"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/containerd/containerd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.12"},{"introduced":"2.2.0"},{"fixed":"2.2.8"},{"introduced":"2.3.0"},{"fixed":"2.3.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.29-slfo.1.1_5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.29-16.119.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.1-0ubuntu4~16.04","0.2.3-0ubuntu1~16.04","0.2.5-0ubuntu1~16.04.1","1.2.6-0ubuntu1~16.04.2","1.2.6-0ubuntu1~16.04.3","1.2.6-0ubuntu1~16.04.4","1.2.6-0ubuntu1~16.04.5","1.2.6-0ubuntu1~16.04.6","1.2.6-0ubuntu1~16.04.6+esm1","1.2.6-0ubuntu1~16.04.6+esm2","1.2.6-0ubuntu1~16.04.6+esm4","1.2.6-0ubuntu1~16.04.6+esm5","1.2.6-0ubuntu1~16.04.6+esm6","1.2.6-0ubuntu1~16.04.6+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.5-0ubuntu2","1.2.6-0ubuntu1~18.04.1","1.2.6-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.1","1.3.3-0ubuntu1~18.04.2","1.3.3-0ubuntu1~18.04.3","1.3.3-0ubuntu1~18.04.4","1.4.4-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.1","1.5.2-0ubuntu1~18.04.2","1.5.2-0ubuntu1~18.04.3","1.5.5-0ubuntu3~18.04.1","1.5.5-0ubuntu3~18.04.2","1.5.9-0ubuntu1~18.04.1","1.5.9-0ubuntu1~18.04.2","1.6.12-0ubuntu1~18.04.1","1.6.12-0ubuntu1~18.04.1+esm1","1.6.12-0ubuntu1~18.04.1+esm2","1.6.12-0ubuntu1~18.04.1+esm3","1.6.12-0ubuntu1~18.04.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.10-0ubuntu1","1.3.2-0ubuntu1","1.3.3-0ubuntu1","1.3.3-0ubuntu2","1.3.3-0ubuntu2.1","1.3.3-0ubuntu2.2","1.3.3-0ubuntu2.3","1.4.4-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.1","1.5.2-0ubuntu1~20.04.2","1.5.2-0ubuntu1~20.04.3","1.5.5-0ubuntu3~20.04.1","1.5.5-0ubuntu3~20.04.2","1.5.9-0ubuntu1~20.04.1","1.5.9-0ubuntu1~20.04.4","1.5.9-0ubuntu1~20.04.5","1.5.9-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.1","1.6.12-0ubuntu1~20.04.3","1.6.12-0ubuntu1~20.04.5","1.6.12-0ubuntu1~20.04.6","1.6.12-0ubuntu1~20.04.7","1.6.12-0ubuntu1~20.04.8","1.6.12-0ubuntu1~20.04.8+esm1","1.6.12-0ubuntu1~20.04.8+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-0ubuntu1~20.04.1","1.7.12-0ubuntu2~20.04.1","1.7.24-0ubuntu1~20.04.1","1.7.24-0ubuntu1~20.04.2","1.7.24-0ubuntu1~20.04.2+esm1","1.7.24-0ubuntu1~20.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.5-0ubuntu3","1.5.9-0ubuntu1","1.5.9-0ubuntu2","1.5.9-0ubuntu3","1.5.9-0ubuntu3.1","1.6.12-0ubuntu1~22.04.1","1.6.12-0ubuntu1~22.04.3","1.6.12-0ubuntu1~22.04.5","1.6.12-0ubuntu1~22.04.6","1.6.12-0ubuntu1~22.04.7","1.6.12-0ubuntu1~22.04.8","1.6.12-0ubuntu1~22.04.9","1.6.12-0ubuntu1~22.04.10","1.6.12-0ubuntu1~22.04.11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-0ubuntu1~22.04.1","1.7.12-0ubuntu2~22.04.1","1.7.24-0ubuntu1~22.04.1","1.7.24-0ubuntu1~22.04.2","1.7.27-0ubuntu1~22.04.1","1.7.28-0ubuntu1~22.04.1","1.7.28-0ubuntu1~22.04.1+esm1","2.2.1-0ubuntu1~22.04.1","2.2.1-0ubuntu1~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-0ubuntu2","1.7.12-0ubuntu1","1.7.12-0ubuntu2","1.7.12-0ubuntu3","1.7.12-0ubuntu4","1.7.12-0ubuntu4.1","1.7.19-0ubuntu1~24.04.1","1.7.19+really1.7.12-0ubuntu4.2","1.7.24-0ubuntu1~24.04.1","1.7.24-0ubuntu1~24.04.2","1.7.27-0ubuntu1~24.04.1","1.7.28-0ubuntu1~24.04.1","1.7.28-0ubuntu1~24.04.2","2.2.1-0ubuntu1~24.04.2","2.2.1-0ubuntu1~24.04.3","2.2.1-0ubuntu1~24.04.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.20~ds1-1ubuntu2","1.6.24~ds1-1ubuntu1","1.6.24~ds1-1ubuntu1.1","1.6.24~ds1-1ubuntu1.2","1.6.24~ds1-1ubuntu1.2+esm1","1.6.24~ds1-1ubuntu1.3","1.6.24~ds1-1ubuntu1.3+esm1","1.6.24~ds1-1ubuntu1.3+esm2","1.6.24~ds1-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-10ubuntu1","2.1.9+ds1-2ubuntu1","2.1.9+ds1-3ubuntu1","2.1.9+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-0ubuntu1","2.2.2-0ubuntu2","2.3.4+dfsg1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"containerd-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-0ubuntu1","2.2.2-0ubuntu2","2.3.4+dfsg1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"containerd-app","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.3-0ubuntu3","2.2.1-0ubuntu1","2.2.2-0ubuntu1","2.2.2-0ubuntu1.1","2.2.2-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"containerd-stable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.3-0ubuntu1","2.1.5-0ubuntu1","2.2.1-0ubuntu1","2.2.2-0ubuntu1","2.2.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.24~ds1-8ubuntu1","1.7.24~ds1-10ubuntu1","1.7.24~ds1-10ubuntu1+esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.75.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.0-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hauler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"containerd","product":"containerd"}],"references":[{"url":"https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880c","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/containerd/containerd/commit/5a2a3a759b0d2ad8c821b33c3afc20890daf6d81","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaa","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/containerd/containerd/commit/eebea8c4c912f44b656c8295c9e6607a19b76650","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/containerd/containerd/commit/ff39a972369e2f12fae561a58d658bbf8f2bc318","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/containerd/containerd/releases/tag/v2.0.12","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v2.2.8","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v2.3.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/containerd/containerd/releases/tag/v1.7.35","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7jxh-36q5-gcqv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-53495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53495","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-53495","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53495.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-53495","tags":["advisory"]},{"url":"https://github.com/containerd/containerd","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623855-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88046","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623863-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624381-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268430","tags":["report"]},{"url":"https://bugzilla.suse.com/1268441","tags":["report"]},{"url":"https://bugzilla.suse.com/1274214","tags":["report"]},{"url":"https://bugzilla.suse.com/1280007","tags":["report"]},{"url":"https://bugzilla.suse.com/1282669","tags":["report"]},{"url":"https://bugzilla.suse.com/1285124","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95838","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264923-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-53495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53495","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23493","tags":["web"]},{"url":"https://bugzilla.suse.com/1278624","tags":["report"]},{"url":"https://bugzilla.suse.com/1280111","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]},{"url":"https://bugzilla.suse.com/1280110","tags":["report"]},{"url":"https://bugzilla.suse.com/1283673","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63209","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-53495","title":"containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T17:18:06.885Z","modified":"2026-09-14T17:34:38.488Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-77684","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T17:18:06Z","modified":"2026-09-14T17:34:38Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:28:20.0825Z"}],"ghsa":[{"id":"GHSA-7jxh-36q5-gcqv","title":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service","description":"### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2026-09-09T18:01:33Z","modified":"2026-09-09T18:01:35Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-53495","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T18:17:51.053Z","modified":"2026-09-25T14:10:13.927Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"ALPINE-CVE-2026-53495","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T18:17:51.053Z","modified":"2026-11-03T06:33:06.195607941Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-53495","title":"containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T17:18:06.885Z","modified":"2026-10-31T18:12:01.47668631Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"DEBIAN-CVE-2026-53495","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T18:17:51.053Z","modified":"2026-10-10T11:00:09.713688464Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-7jxh-36q5-gcqv","title":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service","description":"### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)","status":"published","published":"2026-09-09T18:01:33Z","modified":"2026-09-17T17:40:55.122822852Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"UBUNTU-CVE-2026-53495","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T18:17:00Z","modified":"2026-10-22T16:15:29.332911749Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-100986","title":"CVE-2026-53495 affecting package moby-containerd-cc for versions less than 1.7.7-19","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T18:17:51Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.128158Z"},{"id":"AZL-101004","title":"CVE-2026-53495 affecting package containerd2 for versions less than 2.3.7-1","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","status":"published","published":"2026-09-14T18:17:51Z","modified":"2026-11-02T14:15:26.278307496Z","updated_at":"2026-11-02T15:28:00.253976Z"},{"id":"BELL-CVE-2026-53495","status":"published","published":"2026-09-08T20:25:23.270863Z","modified":"2026-09-19T07:15:04.886363252Z","updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"GO-2026-6444","title":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd","description":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd","status":"published","published":"2026-09-16T16:56:22Z","modified":"2026-09-17T17:30:11.249324699Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:11766-1","title":"hauler-2.1.0-4.1 on GA media","description":"These are all security issues fixed in the hauler-2.1.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-12T00:00:00Z","modified":"2026-09-13T12:15:04.269736265Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:11977-1","title":"trivy-0.75.0-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.75.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-02T00:00:00Z","modified":"2026-10-03T17:23:10.732194924Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12342-1","title":"containerd-2.4.2-1.1 on GA media","description":"These are all security issues fixed in the containerd-2.4.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:07.691798197Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21835-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\n- CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service (bsc#1280111).\n- CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication\n  callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).\n- CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection deadlocks and\n  denial of service (bsc#1278624).\n- CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can cause connection\n  deadlocks and denial of service (bsc#1278624).\n","status":"published","published":"2026-09-14T13:06:15Z","modified":"2026-09-15T17:00:06.114811433Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:21897-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:36:27Z","modified":"2026-09-25T18:23:11.534555779Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22116-1","title":"Security update for hauler","description":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update to 2.1.1:\n  * bumped go version to v1.26.7 (backport #771)\n  * https registry auth fix (backport #763)\n  * adjust supporting artifact retrieval (backport #777)\n  * reject --platform on digest-pinned multi-platform images\n  * fix: serve registry returns an empty /v2/_catalog list\n  * added airgapped support for install.sh and added windows\n    install.ps1\n  * added/fixed basic auth with registry and fileserver\n  * fixed store inventory race with concurrent processes\n  * added type filter to store copy\n  * fixed missing dirs in containers\n  * updated github workflows with versions, permissions, and\n    concurrency\n\n- update vendor.tar to fix:\n  * bsc#1280110, CVE-2026-53495\n","status":"published","published":"2026-10-14T07:40:11Z","modified":"2026-10-19T17:23:14.592172124Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23855-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:15.791415126Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23863-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:16.587575494Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24381-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP\n  response body reading (bsc#1274214).\n- CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).\n- CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation (bsc#1268430).\n- CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container\n  start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282669).\n- CVE-2026-53495: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280007).\n- CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time\n  complexity in unpack handler and can lead to DoS (bsc#1285124).\n","status":"published","published":"2026-10-23T08:05:50Z","modified":"2026-10-27T17:23:19.484667937Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4923-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP\n  response body reading (bsc#1274214).\n- CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).\n- CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container\n  start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282669).\n- CVE-2026-53495: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280007).\n- CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time\n  complexity in unpack handler and can lead to DoS (bsc#1285124).\n","status":"published","published":"2026-10-27T17:09:41Z","modified":"2026-10-28T12:00:03.997491904Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}