containerd Updates Bound OCI Image Graph Processing
Tech GuruQuick Answer
A crafted OCI image index can exhaust containerd's CPU and memory during an image pull, before a container starts. Update the runtime through the channel that manages your host or cluster. The upstream fixed releases are 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 for the listed branches.
Confirm Scope And Apply The Supported Fix
Next step: Find every affected runtime, including build workers and cluster nodes. Confirm your distribution or platform's fix and rollout procedure; until then, limit image pulls to trusted sources as the project advises.
Last verified: 2026-09-26 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | containerd 1.7 and supported 2.x branches |
|---|---|
| Advisory | GHSA-pg57-6jwg-q645 |
| CVE | CVE-2026-53493 |
| Authoritative release date | 2026-09-24 23:44:51 UTC |
| Authority revision date | 2026-09-24 23:44:51 UTC |
| Affected versions | github.com/containerd/containerd/v2 >= 2.0.0 < 2.0.13, >= 2.1.0 < 2.2.9, >= 2.3.0 < 2.3.6, 2.4.0; github.com/containerd/containerd <= 1.7.35 |
| Fixed version | github.com/containerd/containerd/v2 2.4.1, 2.3.6, 2.2.9, 2.0.13; github.com/containerd/containerd 1.7.36 |
| CVSS base score | 6.9 (official CVSS v4.0) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The vulnerable traversal repeatedly processes an image index's descriptor graph without adequate limits and deduplication. A container does not have to run to trigger the resource pressure. Image provenance therefore matters at the pull boundary, not only when approving a workload for execution.
What To Validate Now
- Inventory. Locate containerd 1.7 and supported 2.x branches deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: github.com/containerd/containerd/v2 >= 2.0.0 < 2.0.13, >= 2.1.0 < 2.2.9, >= 2.3.0 < 2.3.6, 2.4.0; github.com/containerd/containerd <= 1.7.35 Do not infer applicability from product family or severity alone.
- Remediate. Apply github.com/containerd/containerd/v2 2.4.1, 2.3.6, 2.2.9, 2.0.13; github.com/containerd/containerd 1.7.36 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Verify the active runtime version, pull approved representative images, and check node resource use and workload startup. For a cluster, follow its drain and maintenance procedures. Exercise malformed-image regression cases only in an isolated environment with resource limits.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
