Live › vulnerability › CVE-2026-53493
Go to dashboardcontainerd, the container runtime behind Kubernetes and many other platforms, can be made to use very high CPU and memory while pulling an image when the image's OCI index is crafted to amplify the graph. An attacker who can get a crafted image pulled on a node can stall container creation and, at larger sizes, destabilize the node or runtime.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/containerd/containerd | go | < 1.7.36 | 1.7.36 |
| github.com/containerd/containerd/v2 | go | >= 2.4.0, < 2.4.1 | 2.0.13, 2.2.9, 2.3.6, 2.4.1 |
Run containerd --version on each node and compare against the fixed releases listed in the fix line.
For Go builds, check the module version of github.com/containerd/containerd or github.com/containerd/containerd/v2 in go.mod.
1.7.36, , , , or (the fixed release on the same minor line)2.0.132.2.92.3.62.4.12.4.0 and < 2.4.1, so 2.4.1 is the fix for that lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-53493")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.