---
id: CVE-2026-53493
title: containerd is an open-source container runtime
summary: >-
  containerd is an open-source container runtime. Prior to versions 1.7.36,
  2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high
  CPU/memory usage during PullImage (before container start), causing long
  ContainerCr…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-400
  - CWE-770
  - CWE-834
vendor: containerd
product: containerd
affected:
  - 'containerd >= 2.0.0, < 2.0.13'
  - containerd < 1.7.36
  - 'containerd >= 2.1.0, < 2.2.9'
  - 'containerd >= 2.3.0, < 2.3.6'
  - containerd = 2.4.0
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T14:10:13.927'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53493'
references:
  - url: >-
      https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53493'
  - url: >-
      https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe
  - url: >-
      https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8
  - url: 'https://github.com/containerd/containerd/releases/tag/v1.7.36'
  - url: 'https://github.com/containerd/containerd/releases/tag/v2.0.13'
  - url: 'https://github.com/containerd/containerd/releases/tag/v2.2.9'
  - url: 'https://github.com/containerd/containerd/releases/tag/v2.3.6'
  - url: 'https://github.com/containerd/containerd/releases/tag/v2.4.1'
  - url: 'https://github.com/advisories/GHSA-pg57-6jwg-q645'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
epss: 0.00356
epssPercentile: 0.26672
cvssSource: cna
ingestedAt: '2026-09-25T00:56:54.276Z'
aliases:
  - GHSA-pg57-6jwg-q645
ecosystem: go
patched:
  - github.com/containerd/containerd/v2 2.0.13
  - github.com/containerd/containerd 1.7.36
  - github.com/containerd/containerd/v2 2.2.9
  - github.com/containerd/containerd/v2 2.3.6
  - github.com/containerd/containerd/v2 2.4.1
---

## Overview

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53493)

Affected packages:

- `github.com/containerd/containerd/v2 >= 2.0.0, < 2.0.13`
- `github.com/containerd/containerd <= 1.7.35`
- `github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.9`
- `github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.6`
- `github.com/containerd/containerd/v2 = 2.4.0`

Patched in:

- `github.com/containerd/containerd/v2 2.0.13`
- `github.com/containerd/containerd 1.7.36`
- `github.com/containerd/containerd/v2 2.2.9`
- `github.com/containerd/containerd/v2 2.3.6`
- `github.com/containerd/containerd/v2 2.4.1`

Source: https://github.com/advisories/GHSA-pg57-6jwg-q645