{"cve":"CVE-2026-53495","nvd":{"published":"2026-09-14T18:17:51.053","modified":"2026-09-25T14:10:13.927","status":"Awaiting Analysis","description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.8},"cvss_v3":null,"cwes":["CWE-400"],"references":["https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880c","https://github.com/containerd/containerd/commit/5a2a3a759b0d2ad8c821b33c3afc20890daf6d81","https://github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaa","https://github.com/containerd/containerd/commit/eebea8c4c912f44b656c8295c9e6607a19b76650","https://github.com/containerd/containerd/commit/ff39a972369e2f12fae561a58d658bbf8f2bc318"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:53:43.293028046+00:00"},"epss":{"cve":"CVE-2026-53495","score":0.00162,"percentile":0.05327,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7jxh-36q5-gcqv","url":"https://osv.dev/vulnerability/GHSA-7jxh-36q5-gcqv","summary":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service","modified":"2026-09-17T17:40:55.122822852Z","packages":[{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":["<2.0.12"],"fixed":["2.0.12"]},{"ecosystem":"Go","name":"github.com/containerd/containerd","purl":"pkg:golang/github.com/containerd/containerd","ranges":["<1.7.35"],"fixed":["1.7.35"]},{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":[">=2.2.0 <2.2.8"],"fixed":["2.2.8"]},{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":[">=2.3.0 <2.3.5"],"fixed":["2.3.5"]}]},{"id":"GO-2026-6444","url":"https://osv.dev/vulnerability/GO-2026-6444","summary":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd","modified":"2026-09-17T17:30:11.249324699Z","packages":[{"ecosystem":"Go","name":"github.com/containerd/containerd","purl":"pkg:golang/github.com/containerd/containerd","ranges":["<1.7.35"],"fixed":["1.7.35"]},{"ecosystem":"Go","name":"github.com/containerd/containerd/v2","purl":"pkg:golang/github.com/containerd/containerd/v2","ranges":["<2.0.12",">=2.2.0 <2.2.8",">=2.3.0 <2.3.5"],"fixed":["2.0.12","2.2.8","2.3.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}