CVE-2026-53493

Containerd has image-pull DoS via crafted OCI index graph amplification

State: Published
Severity: 6.9 Medium
Published: Sep 25, 2026
Updated: Sep 28, 2026
Reserved: Jun 9, 2026

Description

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-834 Excessive Iteration

Affected Products

Product	Versions
containerdcontainerd	>= 2.0.0, < 2.0.13Affected < 1.7.36Affected >= 2.1.0, < 2.2.9Affected >= 2.3.0, < 2.3.6Affected = 2.4.0Affected

References

https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.