CVE catalog

CVE-2026-53495

containerd: CVE-2026-53495

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1vulnerable
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1vulnerable
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3vulnerable
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2vulnerable
Gogithub.com/containerd/containerd/v2Not reported2.3.5fixed
Gogithub.com/containerd/containerdNot reported1.7.35fixed
Gogithub.com/containerd/containerd/v2Not reported2.2.8fixed
Opensusetrivytumbleweed0.75.0-1.1fixed
Opensusetrivyleap 16.00.74.0-160000.3.1fixed
Opensusehaulertumbleweed2.1.0-4.1fixed
Opensusehaulerleap 16.02.1.1-bp160.1.1fixed
Ubuntucontainerdpro1.7.24~ds1-8ubuntu1vulnerable
Ubuntucontainerdpro1.7.24~ds1-10ubuntu1vulnerable
Ubuntucontainerdpro1.7.24~ds1-10ubuntu1+esm1vulnerable
Ubuntucontainerd-apppro1.7.2-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.12-0ubuntu2~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.24-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.24-0ubuntu1~22.04.2vulnerable
Ubuntucontainerd-apppro1.7.27-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.28-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro1.7.28-0ubuntu1~22.04.1+esm1vulnerable
Ubuntucontainerd-apppro2.2.1-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd-apppro2.2.1-0ubuntu1~22.04.2vulnerable
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.1vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.3vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.5vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.6vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.7vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.8vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.9vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.10vulnerable
Ubuntucontainerd22.041.6.12-0ubuntu1~22.04.11vulnerable
Ubuntucontainerd-app24.041.7.2-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu1vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu2vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu3vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4vulnerable
Ubuntucontainerd-app24.041.7.12-0ubuntu4.1vulnerable
Ubuntucontainerd-app24.041.7.19-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.19+really1.7.12-0ubuntu4.2vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.24-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.041.7.27-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.1vulnerable
Ubuntucontainerd-app24.041.7.28-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.042.2.1-0ubuntu1~24.04.2vulnerable
Ubuntucontainerd-app24.042.2.1-0ubuntu1~24.04.3vulnerable
Ubuntucontainerd-app24.042.2.1-0ubuntu1~24.04.4vulnerable
Ubuntucontainerd26.101.7.24~ds1-10ubuntu1vulnerable
Ubuntucontainerd26.102.1.9+ds1-2ubuntu1vulnerable
Ubuntucontainerd26.102.1.9+ds1-3ubuntu1vulnerable
Ubuntucontainerd26.102.1.9+ds1-5ubuntu1vulnerable
Ubuntucontainerd-app26.102.2.2-0ubuntu1vulnerable
Ubuntucontainerd-app26.102.2.2-0ubuntu2vulnerable
Ubuntucontainerd-app26.102.3.4+dfsg1-0ubuntu2vulnerable
Ubuntucontainerd-stable26.102.2.2-0ubuntu1vulnerable
Ubuntucontainerd-stable26.102.2.2-0ubuntu2vulnerable
Ubuntucontainerd-stable26.102.3.4+dfsg1-0ubuntu2vulnerable
Ubuntucontainerd-app26.042.1.3-0ubuntu3vulnerable
Ubuntucontainerd-app26.042.2.1-0ubuntu1vulnerable
Ubuntucontainerd-app26.042.2.2-0ubuntu1vulnerable
Ubuntucontainerd-app26.042.2.2-0ubuntu1.1vulnerable
Ubuntucontainerd-app26.042.2.2-0ubuntu1.2vulnerable
Ubuntucontainerd-stable26.042.1.3-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.1.5-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.1-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.2-0ubuntu1vulnerable
Ubuntucontainerd-stable26.042.2.2-0ubuntu1.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid2.1.9+ds1-4not yet assignedNot reported[1148180]
Debiancontainerdsourceforky2.1.9+ds1-4not yet assignedNot reported[1148180]
Debiancontainerdsourcetrixie(unfixed)not yet assignedNot reported[1148180]
Debiancontainerdsourcebookworm(unfixed)not yet assignedNot reported[1148180]
Gogithub.com/containerd/containerd/v2goNot reported2.3.5Not reportedGHSA-7JXH-36Q5-GCQVNot reported
Gogithub.com/containerd/containerdgoNot reported1.7.35Not reportedGHSA-7JXH-36Q5-GCQVNot reported
Gogithub.com/containerd/containerd/v2goNot reported2.2.8Not reportedGHSA-7JXH-36Q5-GCQVNot reported
Opensusetrivyrpmtumbleweed0.75.0-1.1Not reportedOPENSUSE-SU-2026:11977-1Not reported
Opensusetrivyrpmleap 16.00.74.0-160000.3.1Not reportedOPENSUSE-SU-2026:21835-1Not reported
Opensusehaulerrpmtumbleweed2.1.0-4.1Not reportedOPENSUSE-SU-2026:11766-1Not reported
Opensusehaulerrpmleap 16.02.1.1-bp160.1.1Not reportedOPENSUSE-SU-2026:22116-1Not reported

[Debian bug #1148180]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [containerd]Affected
    Details (4)

    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

  • [golang-github-containerd-containerd-dev]Affected

    Source package: [containerd]

    Details (4)

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Affected

      dsa · containerd · debian · bookworm; dsa · containerd · debian · 12

[Debian 13 (Trixie)]

  • [containerd]Affected
    Details (4)

    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie

      Affected

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie

      Affected

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · amd64 · trixie-security

      Affected

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · arm64 · trixie-security

      Affected

      dsa · containerd · debian · 13

  • [golang-github-containerd-containerd-dev]Affected

    Source package: [containerd]

    Details (4)

    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Affected

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie

      Affected

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Affected

      dsa · containerd · debian · 13

    • 1.7.24~ds1-6+deb13u1 · all · trixie-security

      Affected

      dsa · containerd · debian · 13

[openSUSE Tumbleweed]

  • [hauler]Affected

    Source package: [hauler]

    Details (1)

    • 2.0.3-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 2.1.0-4.1

      dsa · hauler · opensuse · tumbleweed

  • [trivy]Affected

    Source package: [trivy]

    Details (1)

    • 0.74.0-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 0.75.0-1.1

      dsa · trivy · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]