CVE-2026-53493: Containerd Image Pull DoS via Crafted OCI Index Graph Amplification
Summary
CVE-2026-53493: Containerd has image-pull DoS via crafted OCI index graph amplification. Affects github.com/containerd/containerd/v2 across 4 version ranges.
>= 2.0.0, < 2.0.13
>= 2.1.0, < 2.2.9
>= 2.3.0, < 2.3.6
>= 2.4.0, < 2.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-53493 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Containerd is an industry-standard core container runtime that manages the complete lifecycle of containers, including image transfer, storage, and execution. It is widely used in cloud-native environments and supports various container orchestration systems. However, it is susceptible to vulnerabilities that can impact its performance and reliability, particularly during image pull operations.
Vulnerability Detail
A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. The recursive traversal and processing of child descriptors during the PullImage operation lack sufficient depth and breadth limits, leading to excessive resource allocation. This can result in prolonged stalls during container creation and significant resource pressure on the host system, occurring entirely during the image pull phase, prior to any container execution.
How To Fix
Latest published version: v2.4.2 as of 23 Oct 2026
go get github.com/containerd/containerd/v2@v2.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.132.0.13go get github.com/containerd/containerd/v2@v2.0.13 -
>= 2.1.0, < 2.2.92.2.9go get github.com/containerd/containerd/v2@v2.2.9 -
>= 2.3.0, < 2.3.62.3.6go get github.com/containerd/containerd/v2@v2.3.6 -
>= 2.4.0, < 2.4.12.4.1go get github.com/containerd/containerd/v2@v2.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this issue. Users are advised to only pull trusted images from known registries until the patch can be applied.
Conclusion
CVE-2026-53493 represents a significant vulnerability in containerd that can lead to denial of service through crafted OCI image indices. Users are strongly encouraged to update to the patched versions to protect their systems from potential resource exhaustion and performance issues.
See every vulnerability recorded for github.com/containerd/containerd/v2 →
FAQ
CVE-2026-53493 is a vulnerability in containerd that allows for denial of service (DoS) through crafted OCI image indices, leading to excessive CPU and memory usage.
This vulnerability can cause prolonged stalls during container creation and significant resource pressure on the host system when pulling malicious images.
Affected versions include all versions prior to 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring access to the code or installation.
If you cannot update immediately, ensure that you only pull trusted images from known registries to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd/v2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
