CVE-2026-53493: Containerd has image-pull DoS via crafted OCI index graph amplification

Awaiting analysis

AliasesUBUNTU-CVE-2026-53493DEBIAN-CVE-2026-53493CGA-24g2-64vh-rhqj+488 more

Published 25-09-2026Last modified 28-09-2026

Vulnerability summary

CVE-2026-53493 is a medium (CVSS 6.9) Uncontrolled Resource Consumption vulnerability in containerd. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 29.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.36%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

SUSE-SU-2026:24381-1 SUSE-SU-2026:4923-1

Timeline

25-09-2026
PublishedVulnerability first disclosed.
28-09-2026
Last modifiedVulnerability information updated.

Description

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.

CVSS metrics

8 scores · 8 sources · 1 version

v4.06.9

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

amazon-ecs-agent< 1.107.0-r1
amazon-ecs-agent-fips< 1.107.0-r1
atmos< 1.229.0-r2
buildctl< 0.33.0-r3
buildctl-fips< 0.33.0-r4

buildkitd< 0.33.0-r3
buildkitd-fips< 0.33.0-r4
cg< 0.2.364-r1
chainctl< 0.2.363-r1
chainctl-fips< 0.2.364-r1
chaos-mesh< 2.8.4-r8
chaos-mesh-daemon< 2.8.4-r8
chaos-mesh-dashboard< 2.8.4-r8
chaos-mesh-fipsAll versions (No fix recorded) | < 2.8.4-r8
chaos-mesh-fips-daemon< 2.8.4-r8
chaos-mesh-fips-dashboard< 2.8.4-r8
chartmuseum< 0.16.6-r8
chartmuseum-fips< 0.16.6-r8
cloudbeat-8.19< 8.19.22-r1
cloudbeat-9.2< 9.2.8-r29 | < 9.2.8-r28
cloudbeat-9.3< 9.3.8-r12
cloudbeat-9.4< 9.4.7-r1
cloudbeat-9.5< 9.5.4-r1
cloudbeat-fips-8.19< 8.19.22-r1
cloudbeat-fips-9.2< 9.2.8-r28
cloudbeat-fips-9.3< 9.3.8-r12
cloudbeat-fips-9.4< 9.4.7-r1
cloudbeat-fips-9.5< 9.5.4-r1
cluster-api-helm-controller< 0.6.4-r22
cluster-api-helm-controller-fips< 0.6.4-r22
commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-19.2< 19.2.7-r4
commercial-gitlab-rails-ee-19.3< 19.3.3-r4
commercial-gitlab-rails-ee-19.4< 19.4.1-r3
commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
commercial-gitlab-rails-ee-fips-19.2< 19.2.7-r4
commercial-gitlab-rails-ee-fips-19.3< 19.3.3-r4
commercial-gitlab-rails-ee-fips-19.4< 19.4.1-r4
consul-k8s-1.1-cli< 1.1.18-r60
consul-k8s-1.3-cli< 1.3.9-r65
consul-k8s-1.4-cli< 1.4.10-r46
consul-k8s-1.5-cli< 1.5.9-r46
consul-k8s-1.6-cliAll versions (No fix recorded) | < 1.6.10-r39
consul-k8s-1.7-cli< 1.7.13-r28 | All versions (No fix recorded)
consul-k8s-fips-1.1-cli< 1.1.18-r52
consul-k8s-fips-1.3-cli< 1.3.9-r56
consul-k8s-fips-1.4-cli< 1.4.10-r45
consul-k8s-fips-1.5-cli< 1.5.9-r46
consul-k8s-fips-1.6-cli< 1.6.10-r39
consul-k8s-fips-1.7-cli< 1.7.13-r31
containerd-2.1All versions (No fix recorded)
containerd-shim-runc-v2-2.1All versions (No fix recorded)
containerd-stress-2.1All versions (No fix recorded)
crossplane-cli-2.3< 2.3.4-r16
crossplane-cli-2.4< 2.4.1-r8
crossplane-cli-fips-2.3< 2.3.4-r15
crossplane-cli-fips-2.4< 2.4.1-r8
ctr-2.1All versions (No fix recorded)
dagger< 0.21.9-r3
datadog-agent-7.77All versions (No fix recorded)
datadog-agent-7.78All versions (No fix recorded)
datadog-agent-7.79All versions (No fix recorded)
datadog-agent-7.80All versions (No fix recorded)
datadog-agent-7.81All versions (No fix recorded)
datadog-agent-7.82All versions (No fix recorded)
datadog-agent-7.83All versions (No fix recorded)
datadog-agent-7.84< 7.84.1-r1
datadog-agent-fips-7.77All versions (No fix recorded)
datadog-agent-fips-7.78All versions (No fix recorded)
datadog-agent-fips-7.79< 7.79.2-r16
datadog-agent-fips-7.80< 7.80.4-r19
datadog-agent-fips-7.81< 7.81.3-r10
datadog-agent-fips-7.82< 7.82.3-r6
datadog-agent-fips-7.83< 7.83.3-r2
docker-cli-buildx< 0.37.1-r1
docker-cli-buildx-fips< 0.37.1-r2 | All versions (No fix recorded)
docker-compose< 5.5.1-r2
docker-compose-fips< 5.5.1-r2
dockerd-28All versions (No fix recorded)
dockerd-29< 29.8.1-r1
dockerd-fips-28All versions (No fix recorded)
dockerd-fips-29< 29.8.1-r1
dogstatsd-7.77All versions (No fix recorded)
dogstatsd-7.78All versions (No fix recorded)
dogstatsd-7.79All versions (No fix recorded)
dogstatsd-7.80All versions (No fix recorded)
dogstatsd-7.81All versions (No fix recorded)
dogstatsd-7.82All versions (No fix recorded)
dogstatsd-7.83All versions (No fix recorded)
dogstatsd-7.84< 7.84.1-r1
eksctlAll versions (No fix recorded)
envoy-gateway-1.6-egctl< 1.6.7-r15
envoy-gateway-1.7-egctlAll versions (No fix recorded)
envoy-gateway-fips-1.6-egctl< 1.6.7-r20
envoy-gateway-fips-1.7-egctl< 1.7.5-r28
falco-no-driver< 0.45.0-r2
filebeat-oss-7All versions (No fix recorded)
filebeat-oss-fips-7All versions (No fix recorded)
fuse-overlayfs-snapshotterAll versions (No fix recorded) | < 2.1.7-r29
gatekeeper-3.21-gator< 3.21.1-r25
gitlab-rails-ce-18.10All versions (No fix recorded)
gitlab-rails-ce-18.11All versions (No fix recorded)
gitlab-rails-ce-18.8All versions (No fix recorded)
gitlab-rails-ce-18.9All versions (No fix recorded)
gitlab-rails-ce-19.0All versions (No fix recorded)
gitlab-rails-ce-19.1All versions (No fix recorded)
gitlab-rails-ce-19.2< 19.2.7-r2
gitlab-rails-ce-19.3< 19.3.3-r1
gitlab-rails-ce-19.4< 19.4.1-r1
gitlab-rails-ce-fips-18.10All versions (No fix recorded)
gitlab-rails-ce-fips-18.11All versions (No fix recorded)
gitlab-rails-ce-fips-18.8All versions (No fix recorded)
gitlab-rails-ce-fips-18.9All versions (No fix recorded)
gitlab-rails-ce-fips-19.0All versions (No fix recorded)
gitlab-rails-ce-fips-19.1All versions (No fix recorded)
gitlab-rails-ce-fips-19.2< 19.2.7-r1
gitlab-rails-ce-fips-19.3< 19.3.3-r1
gitlab-rails-ce-fips-19.4< 19.4.1-r1
google-osconfig-agentAll versions (No fix recorded) | < 20251028.00-r38
grype< 0.119.0-r1
grype-db< 0.54.3-r12
grype-fips< 0.119.0-r1
harvester< 1.9.0-r1
harvester-fips< 1.9.0-r2
harvester-fips-webhook< 1.9.0-r2
harvester-webhook< 1.9.0-r1
headlamp< 0.45.0-r8
headlamp-fips< 0.45.0-r8
helm-exporter< 1.3.0-r26
helm-exporter-fips< 1.3.0-r25
helm-mapkubeapis< 0.6.1-r34
helm-operator< 1.42.3-r18
helm-operator-fips< 1.42.3-r17
helm-push< 0.11.1-r29
helm-set-status< 0.3.0-r34
k3s-1.31All versions (No fix recorded)
k3s-fips-1.33All versions (No fix recorded)
k3s-fips-1.34All versions (No fix recorded) | < 1.34.12.1-r3
k3s-fips-1.35All versions (No fix recorded) | < 1.35.9.1-r1
k3s-fips-1.36All versions (No fix recorded) | < 1.36.5.1-r3
k3s-fips-1.37All versions (No fix recorded) | < 1.37.1.1-r1
k3s-static< 1.37.0.1-r1
k3s-static-1.31All versions (No fix recorded)
k8sgpt< 0.4.39-r3
k9s< 0.51.0-r22
k9s-fips< 0.51.0-r24
kaniko< 1.25.19-r7
kaniko-fips< 1.25.19-r8
kaniko-warmer< 1.25.19-r7
kaniko-warmer-fips< 1.25.19-r8
kargo-1.10< 1.10.12-r4
kargo-1.11< 1.11.4-r3
kargo-1.8< 1.8.16-r4 | All versions (No fix recorded)
kargo-1.9< 1.9.12-r4
kgateway-2.3All versions (No fix recorded)
kgateway-2.4< 2.4.5-r2
kgateway-fips-2.3< 2.3.9-r2
kgateway-fips-2.4< 2.4.5-r2
kube-arangodb-1.4< 1.4.5-r6
kube-arangodb-fips-1.4All versions (No fix recorded)
kube-mgmt< 11.0.12-r4
kube-mgmt-fips< 11.0.12-r5
kubescape< 4.0.14-r3
kubescape-operator< 0.2.172-r4
kubescape-operator-fips< 0.2.172-r4
kubescape-server-downloader< 4.0.14-r2
kubescape-server-fips< 4.0.14-r2
kubescape-server-fips-downloader< 4.0.14-r2
kubevela-vela-cli< 1.11.0-r17
kubevela-vela-cli-fips< 1.11.0-r18
kubevela-vela-core< 1.11.0-r17
kubevela-vela-core-fips< 1.11.0-r18
livekit-cliAll versions (No fix recorded) | < 2.18.8-r1
manifest-tool< 2.2.2-r17
nerdctl< 2.4.0-r1
nerdctl-fips< 2.4.0-r1
neuvector-controller< 5.6.2-r1
neuvector-controller-fips< 5.6.2-r1
neuvector-enforcer< 5.6.2-r1
neuvector-enforcer-fips< 5.6.2-r1
neuvector-scanner< 4.290-r1
neuvector-scanner-fips< 4.290-r1
neuvector-scanner-task< 4.290-r1
neuvector-scanner-task-fips< 4.290-r1 | All versions (No fix recorded)
neuvector-upgrader< 5.6.2-r1
neuvector-upgrader-fips< 5.6.2-r1
newrelic-infrastructure-agent< 1.80.4-r1
newrelic-infrastructure-agent-fips< 1.80.4-r1
packer< 1.16.1-r1
packer-fips< 1.16.1-r1
rancher-2.10All versions (No fix recorded)
rancher-2.11All versions (No fix recorded)
rancher-2.12< 2.12.14-r1
rancher-2.13< 2.13.10-r1
rancher-2.14< 2.14.6-r1
rancher-agent-2.10All versions (No fix recorded)
rancher-agent-2.11All versions (No fix recorded)
rancher-agent-2.12< 2.12.14-r1

Show all 198

Alpine2 products

containerd< 2.3.6-r0
docker< 29.8.2-r0

2 vendors · 200 products · Showing 200 of 304

References

16 links

github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645X Refsource CONFIRMREPORTAdvisoryWEB
ubuntu.com/security/CVE-2026-53493REPORT
www.cve.org/CVERecord?id=CVE-2026-53493REPORT
security-tracker.debian.org/tracker/CVE-2026-53493Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53493.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-53493AdvisoryOval
github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619feWEBFIX
github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8WEBFIX
github.com/containerd/containerdPACKAGE
github.com/containerd/containerd/releases/tag/v1.7.36WEB

Show all 16 references