CVE-2026-53495

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53495
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53495.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-53495
Aliases
Downstream
Related
Published
2026-09-14T17:18:06Z
Modified
2026-09-16T03:47:04Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
Details

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53495.json"
}
References

Affected packages

Git / github.com/containerd/containerd

Affected ranges

Type
GIT
Repo
https://github.com/containerd/containerd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
207ad711eabd375a01713109a8a197d197ff6542
Introduced
1c4457e00facac03ce1d75f7b6777a7a851e5c41
Introduced
2976f38ccbfcda5ef1364d63d60b0a304e4bf94a
Fixed
0fab6e1c57c38c945dd004bd1d560d1b0915822f
Fixed
f8877dc22535f7c22699399c1dfe6160018792fa
Fixed
941d3ed89ad60ad91cac377a16ecde23e2143083
Fixed
1294c24a7da8e5a793ed378161673abe94118892
Fixed
22ccf4314d1fe0834f8e28f10d37d5305ef9880c
Fixed
5a2a3a759b0d2ad8c821b33c3afc20890daf6d81
Fixed
9ec55f024041d0641f6d79841e45c8781141ddaa
Fixed
eebea8c4c912f44b656c8295c9e6607a19b76650
Fixed
ff39a972369e2f12fae561a58d658bbf8f2bc318
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.35"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.12"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.8"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.3.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.2
0.0.3
0.0.4
0.0.5
api/v1.*
api/v1.11.1
api/v1.6.0-beta.1
api/v1.6.0-beta.2
api/v1.6.0-beta.3
api/v1.7.19
v0.*
v0.2.0
v1.*
v1.0.0
v1.0.0-alpha0
v1.0.0-alpha1
v1.0.0-alpha2
v1.0.0-alpha3
v1.0.0-alpha4
v1.0.0-alpha5
v1.0.0-alpha6
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-rc.0
v1.1.0
v1.1.0-rc.0
v1.1.0-rc.1
v1.1.0-rc.2
v1.2.0
v1.2.0-beta.0
v1.2.0-beta.1
v1.2.0-beta.2
v1.2.0-rc.0
v1.2.0-rc.1
v1.2.0-rc.2
v1.3.0
v1.3.0-beta.0
v1.3.0-beta.1
v1.3.0-beta.2
v1.3.0-rc.0
v1.3.0-rc.1
v1.3.0-rc.2
v1.3.0-rc.3
v1.4.0
v1.4.0-beta.0
v1.4.0-beta.1
v1.4.0-beta.2
v1.4.0-rc.0
v1.4.0-rc.1
v1.5.0
v1.5.0-beta.0
v1.5.0-beta.1
v1.5.0-beta.2
v1.5.0-beta.3
v1.5.0-beta.4
v1.5.0-rc.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.5.0-rc.3
v1.6.0
v1.6.0-beta.0
v1.6.0-beta.1
v1.6.0-beta.2
v1.6.0-beta.3
v1.6.0-beta.4
v1.6.0-beta.5
v1.6.0-rc.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.0-rc.3
v1.6.0-rc.4
v1.7.0
v1.7.0-beta.0
v1.7.0-beta.1
v1.7.0-beta.2
v1.7.0-beta.3
v1.7.0-beta.4
v1.7.0-rc.0
v1.7.0-rc.1
v1.7.0-rc.2
v1.7.0-rc.3
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18
v1.7.19
v1.7.2
v1.7.20
v1.7.21
v1.7.22
v1.7.23
v1.7.24
v1.7.25
v1.7.26
v1.7.27
v1.7.28
v1.7.29
v1.7.3
v1.7.30
v1.7.31
v1.7.32
v1.7.33
v1.7.34
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53495.json"