Skip to content
OpenAdvisories
Medium · 6.9 CVE-2026-53493 EUVD-2026-86486GHSA-pg57-6jwg-q645GO-2026-6597

Containerd has image-pull DoS via crafted OCI index graph amplification

Published Sep 25, 2026 · Updated Sep 28, 2026 · Assigned by GitHub_M

Vendor: containerd Product: containerd Package: buildctl Package: buildkitd Package: chartmuseum Package: cluster-api-helm-controller Package: containerd Package: containerd Package: containerd Package: containerd-app Package: containerd-stable Package: containerd2 Package: dagger Package: datadog-agent-7.77 Package: datadog-agent-7.78 Package: datadog-agent-7.79 Package: datadog-agent-7.80 Package: datadog-agent-7.81 Package: docker Package: docker-cli-buildx Package: docker-compose Package: dockerd-28 Package: dockerd-29 Package: dogstatsd-7.77 Package: dogstatsd-7.78 Package: dogstatsd-7.79 Package: dogstatsd-7.80 Package: dogstatsd-7.81 Package: eksctl Package: falco-no-driver Package: fuse-overlayfs-snapshotter Package: github.com/containerd/containerd Package: github.com/containerd/containerd/v2 Package: grype Package: headlamp Package: helm-mapkubeapis Package: helm-operator Package: helm-push Package: helm-set-status Package: k3s-static Package: k8sgpt Package: k9s Package: kaniko Package: kaniko-warmer Package: kargo-1.10 Package: kube-arangodb-1.4 Package: kubescape Package: kubescape-operator Package: kubevela-vela-cli Package: kubevela-vela-core Package: manifest-tool Package: moby-containerd-cc Package: nerdctl Package: neuvector-scanner Package: neuvector-scanner-task Package: newrelic-infrastructure-agent Package: rancher-2.13 Package: rancher-2.14 Package: rancher-agent-2.13 Package: rancher-agent-2.14 Package: rancher-helm-3 Package: scorecard Package: skaffold Package: spegel Package: steampipe Package: syft Package: trivy Package: trivy-operator Package: wolfictl Package: xeol Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.

Affected products

VendorProductAffectedFixed
containerd containerd >= 2.0.0, < 2.0.13, < 1.7.36, >= 2.1.0, < 2.2.9, >= 2.3.0, < 2.3.6, = 2.4.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 containerd 2.1.9+ds1-5 —
Debian 13 containerd No fix yet —
Debian 12 containerd No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 containerd +2 No fix yet —
Ubuntu 26.04 LTS containerd-app +1 No fix yet —
Ubuntu 24.04 LTS containerd-app No fix yet —
Ubuntu 22.04 LTS containerd No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS containerd No fix yet —
Ubuntu Pro 24.04 LTS containerd No fix yet —
Ubuntu Pro 22.04 LTS containerd-app No fix yet —
Ubuntu Pro 20.04 LTS containerd +1 No fix yet —
Ubuntu Pro 18.04 LTS containerd No fix yet —
Ubuntu Pro 16.04 LTS containerd No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1
SLES 12 SP5 containerd 1.7.29-16.119.1 SUSE-SU-2026:4923-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 containerd 1.7.29-slfo.1.1_5.1 SUSE-SU-2026:24381-1
SLE Micro 5.5 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1
SLE Micro 5.4 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1
SLE Micro 5.3 containerd 1.7.29-150000.152.1 SUSE-SU-2026:5201-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed elemental 3.0.4-1.1 openSUSE-SU-2026:12127-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 containerd 2.3.6-r0 —
Alpine v3.24 docker 29.8.2-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 containerd +1 2.3.7-1.amzn2023.0.1 ALAS2023-2026-3273

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 containerd2 2.3.6-1 —
Azure Linux 3 moby-containerd-cc 1.7.7-19 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling buildctl +1 0.33.0-r3 —
Wolfi rolling chartmuseum 0.16.6-r8 —
Wolfi rolling cluster-api-helm-controller 0.6.4-r22 —
Wolfi rolling dagger 0.21.9-r3 —
Wolfi rolling docker-cli-buildx 0.37.1-r1 —
Wolfi rolling docker-compose 5.5.1-r2 —
Wolfi rolling dockerd-28 +10 No fix yet —
Wolfi rolling dockerd-29 29.8.1-r1 —
Wolfi rolling eksctl 0.230.0-r8 —
Wolfi rolling falco-no-driver 0.45.0-r2 —
Wolfi rolling fuse-overlayfs-snapshotter 2.1.7-r29 —
Wolfi rolling grype 0.119.0-r1 —
Wolfi rolling headlamp 0.45.0-r8 —
Wolfi rolling helm-mapkubeapis 0.6.1-r34 —
Wolfi rolling helm-operator 1.42.3-r18 —
Wolfi rolling helm-push 0.11.1-r29 —
Wolfi rolling helm-set-status 0.3.0-r34 —
Wolfi rolling k3s-static 1.37.0.1-r1 —
Wolfi rolling k8sgpt 0.4.39-r3 —
Wolfi rolling k9s 0.51.0-r22 —
Wolfi rolling kaniko +1 1.25.19-r7 —
Wolfi rolling kargo-1.10 1.10.12-r4 —
Wolfi rolling kube-arangodb-1.4 1.4.5-r6 —
Wolfi rolling kubescape 4.0.14-r3 —
Wolfi rolling kubescape-operator 0.2.172-r4 —
Wolfi rolling kubevela-vela-cli +1 1.11.0-r17 —
Wolfi rolling manifest-tool 2.2.2-r17 —
Wolfi rolling nerdctl 2.4.0-r1 —
Wolfi rolling neuvector-scanner +1 4.290-r1 —
Wolfi rolling newrelic-infrastructure-agent 1.80.4-r1 —
Wolfi rolling rancher-2.13 +1 2.13.10-r1 —
Wolfi rolling rancher-2.14 +1 2.14.6-r1 —
Wolfi rolling rancher-helm-3 3.20.0-r29 —
Wolfi rolling scorecard 5.5.0-r24 —
Wolfi rolling skaffold 2.25.0-r3 —
Wolfi rolling spegel 0.7.4-r12 —
Wolfi rolling steampipe 2.4.7-r2 —
Wolfi rolling syft 1.52.0-r2 —
Wolfi rolling trivy 0.74.0-r9 —
Wolfi rolling trivy-operator 0.34.0-r7 —
Wolfi rolling wolfictl 0.39.27-r1 —
Wolfi rolling xeol 0.10.8-r64 —
Wolfi rolling zarf 0.86.0-r1 —
Wolfi rolling zot 2.1.21-r5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/containerd/containerd < 1.7.36 1.7.36 GHSA-pg57-6jwg-q645
Go github.com/containerd/containerd/v2 >= 2.0.0, < 2.0.13 2.0.13 GHSA-pg57-6jwg-q645
Go github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.9 2.2.9 GHSA-pg57-6jwg-q645
Go github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.6 2.3.6 GHSA-pg57-6jwg-q645
Go github.com/containerd/containerd/v2 >= 2.4.0, < 2.4.1 2.4.1 GHSA-pg57-6jwg-q645
Go github.com/containerd/containerd/v2 >= 2.0.0, < 2.0.13 · >= 2.1.0, < 2.2.9 · >= 2.3.0, < 2.3.6 · >= 2.4.0, < 2.4.1 2.0.13, 2.2.9, 2.3.6, 2.4.1 GO-2026-6597

Advisories 5

References