containerd OCI image importer memory exhaustion
Description
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/containerd/containerdGo | < 1.5.18 | 1.5.18 |
github.com/containerd/containerdGo | >= 1.6.0, < 1.6.18 | 1.6.18 |
Affected products
1- Range: < 1.5.18
Patches
10c314901076aMerge pull request from GHSA-259w-8hf6-59c2
1 file changed · +7 −5
images/archive/importer.go+7 −5 modified@@ -232,12 +232,14 @@ func ImportIndex(ctx context.Context, store content.Store, reader io.Reader, opt return writeManifest(ctx, store, idx, ocispec.MediaTypeImageIndex) } +const ( + kib = 1024 + mib = 1024 * kib + jsonLimit = 20 * mib +) + func onUntarJSON(r io.Reader, j interface{}) error { - b, err := io.ReadAll(r) - if err != nil { - return err - } - return json.Unmarshal(b, j) + return json.NewDecoder(io.LimitReader(r, jsonLimit)).Decode(j) } func onUntarBlob(ctx context.Context, r io.Reader, store content.Ingester, size int64, ref string) (digest.Digest, error) {
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
7- github.com/advisories/GHSA-259w-8hf6-59c2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-25153ghsaADVISORY
- github.com/containerd/containerd/commit/0c314901076a74a7b797a545d2f462285fdbb8c4ghsax_refsource_MISCWEB
- github.com/containerd/containerd/releases/tag/v1.5.18ghsax_refsource_MISCWEB
- github.com/containerd/containerd/releases/tag/v1.6.18ghsax_refsource_MISCWEB
- github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2ghsax_refsource_CONFIRMWEB
- pkg.go.dev/vuln/GO-2023-1573ghsaWEB
News mentions
0No linked articles in our index yet.