CVE-2026-53495
Received Received - Intake

Memory Exhaustion in containerd via CRI ExecSync

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-53495
EUVD
EUVD-2026-77684

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
containerd containerd to 1.7.35 (inc)
containerd containerd to 2.0.12 (inc)
containerd containerd to 2.2.8 (inc)
containerd containerd to 2.3.5 (inc)
containerd containerd 1.7.35
containerd containerd 2.0.12
containerd containerd 2.2.8
containerd containerd 2.3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53495 is a denial-of-service (DoS) vulnerability in containerd's CRI plugin. When ExecSync is used with long-lived background child processes on Linux, the drainExecSyncIO function blocks indefinitely due to lack of timeout or context cancellation handling. This causes resource exhaustion, triggering the OOM killer to terminate containerd, making the runtime unavailable until restart.

Detection Guidance

Check containerd version with: containerd --version. If running Linux with CRI enabled and version is below 1.7.35, 2.0.12, 2.2.8, or 2.3.5, the system is vulnerable. Monitor for containerd crashes or OOM killer events indicating resource exhaustion.

Impact Analysis

If you run containerd on Linux with the CRI plugin enabled, repeated ExecSync calls with long-lived background processes can accumulate blocked goroutines and memory leaks. This may crash containerd via the OOM killer, disrupting container operations until a restart. Systems not using CRI or running on non-Linux platforms are unaffected.

Compliance Impact

This vulnerability primarily causes resource exhaustion leading to denial-of-service conditions in containerd, which could disrupt containerized workloads. While not directly violating GDPR or HIPAA, such disruptions may impact availability of systems handling personal or health data, potentially violating requirements for continuous access under these regulations.

Mitigation Strategies

Upgrade containerd to patched versions (1.7.35, 2.0.12, 2.2.8, or 2.3.5) immediately. Avoid using exec probes or lifecycle hooks that launch long-lived background child processes in Linux CRI deployments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart