CVE-2022-23471: containerd CRI stream server vulnerable to host memory exhaustion
Summary
CVE-2022-23471: containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd. Affects github.com/containerd/containerd across 2 version ranges.
< 1.5.16
>= 1.6.0, < 1.6.12
Fixed in 1.5.16 or 1.6.12, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2022-23471 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/containerd/containerd, which is written in Go. containerd is an open-source container runtime that provides a reliable and scalable foundation for container deployments. It is widely used in various container orchestration platforms. The CRI (Container Runtime Interface) stream server in containerd is responsible for handling terminal input and output for containers. This vulnerability affects versions 0.x and 1.6.0 to 1.6.11 of containerd.
Vulnerability Detail
The vulnerability in the containerd CRI stream server allows an attacker to exhaust the host's memory by exploiting a flaw in the handling of terminals. By sending specially crafted terminal input, an attacker can cause the stream server to consume excessive memory resources, leading to a denial-of-service condition. This vulnerability can be exploited remotely, potentially impacting the availability of containerized applications and the overall stability of the host system.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.5.161.5.16go get github.com/containerd/containerd@v1.5.16 -
>= 1.6.0, < 1.6.121.6.12go get github.com/containerd/containerd@v1.6.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of containerd.
Conclusion
The containerd CRI stream server vulnerability (CVE-2022-23471) exposes a potential denial-of-service risk for containerized applications. Upgrading to containerd version 1.6.12 or later is necessary to address this vulnerability and ensure the stability and availability of container deployments.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
containerd is an open-source container runtime that provides a reliable and scalable foundation for container deployments. It is widely used in various container orchestration platforms.
The CRI stream server in containerd is responsible for handling terminal input and output for containers. It allows users to interact with containers through a terminal interface.
This vulnerability can lead to a denial-of-service condition, potentially impacting the availability of containerized applications. It can cause excessive memory consumption, leading to performance degradation or system instability.
Yes, this vulnerability can be exploited remotely. An attacker can send specially crafted terminal input to the CRI stream server, triggering the memory exhaustion issue.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to a patched version of containerd to mitigate the issue.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
