---
id: "CVE-2026-53493"
kind: "vulnerability"
aliases: ["CVE-2026-53493", "GHSA-pg57-6jwg-q645", "GO-2026-6597"]
title: "Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd"
severity: "medium"
cvss: 6.9
epss: 0.00356
exploited: false
status: "open"
category: "runtime"
products: [{"name": "github.com/containerd/containerd", "fixed": ["1.7.36"], "affected": "< 1.7.36", "ecosystem": "go"}, {"name": "github.com/containerd/containerd/v2", "fixed": ["2.0.13", "2.2.9", "2.3.6", "2.4.1"], "affected": ">= 2.4.0, < 2.4.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["containerd", "go", "kubernetes", "runtime", "self-hosted"]
not_affected_if: ["containerd-not-used", "managed-hosting", "only-trusted-image-sources"]
published_at: "2026-09-25T01:16:48+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:25+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6597", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-53493", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53493", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd

containerd, the container runtime behind Kubernetes and many other platforms, can be made to use very high CPU and memory while pulling an image when the image's OCI index is crafted to amplify the graph. An attacker who can get a crafted image pulled on a node can stall container creation and, at larger sizes, destabilize the node or runtime.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/containerd/containerd affected < 1.7.36 fixed 1.7.36
- go:github.com/containerd/containerd/v2 affected >= 2.4.0, < 2.4.1 fixed 2.0.13, 2.2.9, 2.3.6, 2.4.1

## How to check

Run `containerd --version` on each node and compare against the fixed releases listed in the fix line.
For Go builds, check the module version of github.com/containerd/containerd or github.com/containerd/containerd/v2 in go.mod.

## Fix

Upgrade containerd to 1.7.36, 2.0.13, 2.2.9, 2.3.6, or 2.4.1 (the fixed release on the same minor line).
For the v2 module, the affected range is >= 2.4.0 and < 2.4.1, so 2.4.1 is the fix for that line.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6597
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-53493
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53493

## From the sources

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_