CVE-2026-53493: Containerd Image-Pull DoS via Crafted OCI Index Graph Amplification
Summary
CVE-2026-53493: Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd. Affects github.com/containerd/containerd versions < 1.7.36. Fixed in 1.7.36. How to fix ↓
Also tracked for
The same CVE-2026-53493 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Containerd is an industry-standard core container runtime that manages the complete container lifecycle, including image transfer, container execution, and storage. It is widely used in cloud-native environments and is integral to Kubernetes and other container orchestration platforms. However, it is susceptible to a denial-of-service (DoS) attack through crafted OCI index graph amplification, which can disrupt image-pull operations.
Vulnerability Detail
The vulnerability arises from the way Containerd processes OCI index graphs. An attacker can craft a malicious OCI index that, when pulled, amplifies the resource consumption on the server, leading to a denial-of-service condition. This can result in significant downtime and resource exhaustion, affecting the availability of containerized applications. The vulnerability affects multiple versions of the Containerd package, specifically those prior to the patched versions.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.36
This is the first release that contains the fix.
go get github.com/containerd/containerd@v1.7.36Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent image pulls or implement rate limiting on your container registry to mitigate the impact of this vulnerability until you can apply the patch.
Conclusion
CVE-2026-53493 represents a significant vulnerability in Containerd that can lead to denial-of-service conditions through crafted OCI index graphs. It is crucial to update to the patched versions to ensure the security and availability of your containerized applications.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
CVE-2026-53493 is a vulnerability in Containerd that allows for a denial-of-service attack via crafted OCI index graph amplification.
This vulnerability can lead to resource exhaustion and downtime for applications relying on Containerd for image management.
Versions of Containerd prior to 1.7.36 and 2.0.13, 2.2.9, 2.3.6, and 2.4.1 for the v2 package are affected.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update immediately, consider implementing rate limiting on your container registry and limiting concurrent image pulls as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
