Denial of Service in containerd

Executive Summary

CVE-2026-47262 is a vulnerability in containerd, an open-source container runtime. It allows a maliciously crafted container image to cause a Denial of Service (DoS) condition by triggering memory exhaustion when a container is created from that image.

This memory exhaustion leads to an Out Of Memory (OOM) kill of the containerd process, which makes the container runtime API unavailable and disrupts clients such as Docker Engine or Kubernetes control-plane components.

The root cause is unbounded group parsing in the image-triggered runtime. The vulnerability affects containerd versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2, where patches have been released to fix the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) condition in your container runtime environment.

When exploited, it leads to memory exhaustion and an Out Of Memory (OOM) kill of the containerd process, which makes the container runtime API unavailable.

This disruption can affect critical clients such as Docker Engine or Kubernetes control-plane components, potentially causing downtime or loss of availability for containerized applications.

As a mitigation, it is recommended to update to the fixed versions and restrict image imports to trusted sources and users with appropriate permissions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability causes a Denial of Service (DoS) condition by exhausting memory when a container is created from a maliciously crafted image, leading to an Out Of Memory (OOM) kill of the containerd process.

Detection can involve monitoring for unexpected OOM kills of the containerd process or disruptions in the container runtime API availability, which may affect Docker Engine or Kubernetes control-plane components.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to update containerd to a patched version: 1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2.

As a temporary measure before updating, restrict usage to only trusted container images and limit image import or pod scheduling permissions to trusted users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) condition by exhausting memory and killing the containerd process, which disrupts the container runtime API and affects clients such as Docker Engine or Kubernetes control-plane components.

While the CVE description and resources detail the technical impact and mitigation steps, they do not explicitly address how this vulnerability affects compliance with common standards and regulations like GDPR or HIPAA.

Useful 0 Not Useful 0