{"id":"CVE-2026-53493","kind":"vulnerability","aliases":["CVE-2026-53493","GHSA-pg57-6jwg-q645","GO-2026-6597"],"related":[],"title":"Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","summary":"containerd, the container runtime behind Kubernetes and many other platforms, can be made to use very high CPU and memory while pulling an image when the image's OCI index is crafted to amplify the graph. An attacker who can get a crafted image pulled on a node can stall container creation and, at larger sizes, destabilize the node or runtime.","severity":"medium","cvss":6.9,"epss":0.00356,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/containerd/containerd","fixed":["1.7.36"],"affected":"< 1.7.36","ecosystem":"go"},{"name":"github.com/containerd/containerd/v2","fixed":["2.0.13","2.2.9","2.3.6","2.4.1"],"affected":">= 2.4.0, < 2.4.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["containerd","go","kubernetes","runtime","self-hosted"],"not_affected_if":["containerd-not-used","managed-hosting","only-trusted-image-sources"],"how_to_check":"Run `containerd --version` on each node and compare against the fixed releases listed in the fix line.\nFor Go builds, check the module version of github.com/containerd/containerd or github.com/containerd/containerd/v2 in go.mod.","fix":"Upgrade containerd to 1.7.36, 2.0.13, 2.2.9, 2.3.6, or 2.4.1 (the fixed release on the same minor line).\nFor the v2 module, the affected range is >= 2.4.0 and < 2.4.1, so 2.4.1 is the fix for that line.","status":"open","published_at":"2026-09-25T01:16:48+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:25+00:00","updated_at":"2026-10-23T19:56:25+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-10-23T19:56:25Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade containerd to 1.7.36, 2.0.13, 2.2.9, 2.3.6, or 2.4.1 (the fixed release on the same minor line).\nFor the v2 module, the affected range is >= 2.4.0 and < 2.4.1, so 2.4.1 is the fix for that line.","summary":"containerd, the container runtime behind Kubernetes and many other platforms, can be made to use very high CPU and memory while pulling an image when the image's OCI index is crafted to amplify the graph. An attacker who can get a crafted image pulled on a node can stall container creation and, at larger sizes, destabilize the node or runtime.","category":"runtime","who_cares":["containerd","kubernetes","self-hosted","go"],"confidence":0.75,"analyst_note":"","how_to_check":"Run `containerd --version` on each node and compare against the fixed releases listed in the fix line.\nFor Go builds, check the module version of github.com/containerd/containerd or github.com/containerd/containerd/v2 in go.mod.\nunknown whether a specific config or setting makes a deployment exposed beyond the affected version range.","needs_analyst":false,"not_affected_if":["managed-hosting","containerd-not-used","only-trusted-image-sources"],"severity_if_unknown":"unknown"},"cost_usd":0.000455,"input_tokens":2272,"output_tokens":455,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,26A,29A '-53493':19A,30A '-6597':27A '/containerd/containerd':16A,33A '/containerd/containerd/v2':36A '1.7.36':116C,149C '2.0.13':117C,150C '2.2.9':118C,151C '2.3.6':119C,152C '2.4.1':121C,154C '6jwg':23A 'amplif':12A 'amplifi':77B 'attack':81B 'behind':48B 'caus':138C 'contain':46B,94B,111C,136C 'containercr':140C 'containerd':1A,37B,44B,105C 'cpu':61B 'cpu/memory':131C 'craft':8A,75B,86B,123C 'creation':95B 'cve':17A,28A 'destabil':100B 'dos':6A 'fix':155C 'forc':128C 'get':84B 'ghsa':21A 'ghsa-pg57-6jwg-q645':20A 'github.com':15A,32A,35A 'github.com/containerd/containerd':14A,31A 'github.com/containerd/containerd/v2':34A 'go':25A,38B 'graph':11A,79B,126C 'high':60B,130C 'host':43B 'imag':4A,67B,70B,87B 'image-pul':3A 'index':10A,73B,125C 'instabl':147C 'issu':157C 'kubernet':39B,49B 'larger':98B,144C 'long':139C 'made':56B 'mani':51B 'memori':63B 'node':91B,102B 'node/runtime':146C 'oci':9A,72B,124C 'open':109C 'open-sourc':108C 'pg57':22A 'platform':53B 'prior':113C 'pull':5A,65B,88B 'pullimag':134C 'q645':24A 'runtim':40B,47B,104B,112C 'self':42B 'self-host':41B 'size':99B,145C 'sourc':110C 'stall':93B,141C 'start':137C 'usag':132C 'use':58B 'version':115C,148C 'via':7A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-25T01:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6597","url":"https://pkg.go.dev/vuln/GO-2026-6597","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-53493","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53493","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-53493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53493","severity":null,"published_at":"2026-09-25T01:16:48+00:00","modified_at":"2026-09-28T15:17:17+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}