Resource Exhaustion in containerd on Linux with CRI Plugin Enabled
CVE-2026-53495
What is CVE-2026-53495?
A resource exhaustion vulnerability in containerd occurs when the CRI plugin is enabled on Linux. This issue arises when long-lived background child processes are initiated via Exec probes or lifecycle hooks. The drainExecSyncIO goroutine can become indefinitely blocked due to a lack of a default timeout, resulting in repeated ExecSync requests that accumulate blocked goroutines and consume host memory. Consequently, the Out Of Memory (OOM) killer may terminate the containerd instance, leading to service unavailability until a restart occurs. Users not employing the CRI implementation of containerd, or those operating on non-Linux systems, are not affected by this vulnerability.
Affected Version(s)
containerd < 1.7.35 < 1.7.35
containerd >= 2.0.0, < 2.0.12 < 2.0.0, 2.0.12
containerd >= 2.2.0, < 2.2.8 < 2.2.0, 2.2.8