Medium severityNVD Advisory· Published Sep 25, 2026· Updated Sep 28, 2026
CVE-2026-53493
CVE-2026-53493
Description
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/containerd/containerd/v2Go | >= 2.0.0, < 2.0.13 | 2.0.13 |
github.com/containerd/containerdGo | < 1.7.36 | 1.7.36 |
github.com/containerd/containerd/v2Go | >= 2.1.0, < 2.2.9 | 2.2.9 |
github.com/containerd/containerd/v2Go | >= 2.3.0, < 2.3.6 | 2.3.6 |
github.com/containerd/containerd/v2Go | >= 2.4.0, < 2.4.1 | 2.4.1 |
Affected products
3- ghsa-coords2 versions
>= 2.0.0, < 2.0.13+ 1 more
- (no CPE)range: >= 2.0.0, < 2.0.13
- (no CPE)range: < 1.7.36
- Range: <1.7.36, <2.0.13, <2.2.9, <2.3.6, <2.4.1
Patches
Vulnerability mechanics
References
10- github.com/advisories/GHSA-pg57-6jwg-q645ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-53493ghsaADVISORY
- github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619feghsaWEB
- github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8ghsaWEB
- github.com/containerd/containerd/releases/tag/v1.7.36ghsaWEB
- github.com/containerd/containerd/releases/tag/v2.0.13ghsaWEB
- github.com/containerd/containerd/releases/tag/v2.2.9ghsaWEB
- github.com/containerd/containerd/releases/tag/v2.3.6ghsaWEB
- github.com/containerd/containerd/releases/tag/v2.4.1ghsaWEB
- github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645nvdWEB
News mentions
0No linked articles in our index yet.