CVE-2026-53495: containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
Summary
CVE-2026-53495: containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service. Affects github.com/containerd/containerd/v2 across 3 version ranges.
< 2.0.12
>= 2.2.0, < 2.2.8
>= 2.3.0, < 2.3.5
Fixed in 2.0.12, 2.2.8 or 2.3.5, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-53495 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
containerd is an industry-standard core container runtime that manages the complete container lifecycle, including image transfer, container execution, and supervision. It is widely used in cloud-native environments and is integral to Kubernetes. The package supports various container orchestration systems and provides a robust API for managing containers. However, a recent vulnerability has been identified in its CRI ExecSync implementation, which can lead to resource exhaustion and denial of service.
Vulnerability Detail
A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks that spawn background child processes to block containerd's stdio-drain goroutines indefinitely. This issue arises because the I/O drain phase does not have a default timeout or context cancellation handling. As a result, repeated ExecSync calls that involve long-lived background processes can lead to a leak of goroutines and host memory. Over time, this resource exhaustion can trigger the OOM killer to terminate the containerd daemon, making it unavailable until restarted. This vulnerability specifically affects containerd on Linux systems with the CRI plugin enabled.
How To Fix
Latest published version: v2.4.2 as of 23 Oct 2026
go get github.com/containerd/containerd/v2@v2.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.122.0.12go get github.com/containerd/containerd/v2@v2.0.12 -
>= 2.2.0, < 2.2.82.2.8go get github.com/containerd/containerd/v2@v2.2.8 -
>= 2.3.0, < 2.3.52.3.5go get github.com/containerd/containerd/v2@v2.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, ensure that exec probes and lifecycle hooks do not initiate long-lived background child processes. This can help mitigate the risk of goroutine leaks until the package is updated.
Conclusion
The identified vulnerability in containerd's CRI ExecSync implementation poses a significant risk of resource exhaustion and denial of service for affected users. It is crucial to update to the patched versions to mitigate this risk and ensure the continued availability of container management services.
See every vulnerability recorded for github.com/containerd/containerd/v2 →
FAQ
The vulnerability involves a goroutine leak in containerd's CRI ExecSync implementation, which can lead to resource exhaustion and denial of service.
Users running containerd on Linux systems with the CRI plugin enabled are affected. Those not using containerd's CRI implementation or not running containers on Linux are not impacted.
If exploited, this vulnerability can cause the containerd daemon to be terminated by the OOM killer, leading to unavailability of container management services until a restart occurs.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Without requiring access to the code or installation, you can check your application using the Gopkg.lock file on the Vulert playground.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd/v2.
