CVE-2026-53493
Fixed in a distro release EPSS <1%CVSS 6.9
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | 1.7.36 |
| Go | github.com/containerd/containerd/v2 | 2.0.13 |
| Go | github.com/containerd/containerd/v2 | 2.2.9 |
| Go | github.com/containerd/containerd/v2 | 2.3.6 |
| Go | github.com/containerd/containerd/v2 | 2.4.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | amazon-ecs-agent | 1.107.0-r1 |
| Chainguard | amazon-ecs-agent-fips | 1.107.0-r1 |
| Chainguard | atmos | 1.229.0-r2 |
| Chainguard | buildctl | 0.33.0-r3 |
| Chainguard | buildctl-fips | 0.33.0-r4 |
| Chainguard | buildkitd | 0.33.0-r3 |
| Chainguard | buildkitd-fips | 0.33.0-r4 |
| Chainguard | cg | 0.2.364-r1 |
| Chainguard | chainctl | 0.2.363-r1 |
| Chainguard | chainctl-fips | 0.2.364-r1 |
| Chainguard | chaos-mesh | 2.8.4-r8 |
| Chainguard | chaos-mesh-daemon | 2.8.4-r8 |
| Chainguard | chaos-mesh-dashboard | 2.8.4-r8 |
| Chainguard | chaos-mesh-fips | 2.8.4-r8 |
| Chainguard | chaos-mesh-fips | no fix |
| Chainguard | chaos-mesh-fips-daemon | 2.8.4-r8 |
| Chainguard | chaos-mesh-fips-dashboard | 2.8.4-r8 |
| Chainguard | chartmuseum | 0.16.6-r8 |
| Chainguard | chartmuseum-fips | 0.16.6-r8 |
| Chainguard | cloudbeat-8.19 | 8.19.22-r1 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r29 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r28 |
| Chainguard | cloudbeat-9.3 | 9.3.8-r12 |
| Chainguard | cloudbeat-9.4 | 9.4.7-r1 |
| Chainguard | cloudbeat-9.5 | 9.5.4-r1 |
| Chainguard | cloudbeat-fips-8.19 | 8.19.22-r1 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r28 |
| Chainguard | cloudbeat-fips-9.3 | 9.3.8-r12 |
| Chainguard | cloudbeat-fips-9.4 | 9.4.7-r1 |
| Chainguard | cloudbeat-fips-9.5 | 9.5.4-r1 |
| Chainguard | cluster-api-helm-controller | 0.6.4-r22 |
| Chainguard | cluster-api-helm-controller-fips | 0.6.4-r22 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r4 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r4 |
| Chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r3 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r4 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r4 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r4 |
| Chainguard | consul-k8s-1.1-cli | 1.1.18-r60 |
| Chainguard | consul-k8s-1.3-cli | 1.3.9-r65 |
| Chainguard | consul-k8s-1.4-cli | 1.4.10-r46 |
| Chainguard | consul-k8s-1.5-cli | 1.5.9-r46 |
| Chainguard | consul-k8s-1.6-cli | no fix |
| Chainguard | consul-k8s-1.6-cli | 1.6.10-r39 |
| Chainguard | consul-k8s-1.7-cli | no fix |
| Chainguard | consul-k8s-1.7-cli | 1.7.13-r28 |
| Chainguard | consul-k8s-fips-1.1-cli | 1.1.18-r52 |
| Chainguard | consul-k8s-fips-1.3-cli | 1.3.9-r56 |
| Chainguard | consul-k8s-fips-1.4-cli | 1.4.10-r45 |
| Chainguard | consul-k8s-fips-1.5-cli | 1.5.9-r46 |
| Chainguard | consul-k8s-fips-1.6-cli | 1.6.10-r39 |
| Chainguard | consul-k8s-fips-1.7-cli | 1.7.13-r31 |
| Chainguard | containerd-2.1 | no fix |
| Chainguard | containerd-shim-runc-v2-2.1 | no fix |
| Chainguard | containerd-stress-2.1 | no fix |
| Chainguard | crossplane-cli-2.3 | 2.3.4-r16 |
| Chainguard | crossplane-cli-2.4 | 2.4.1-r8 |
| Chainguard | crossplane-cli-fips-2.3 | 2.3.4-r15 |
| Chainguard | crossplane-cli-fips-2.4 | 2.4.1-r8 |
| Chainguard | ctr-2.1 | no fix |
| Chainguard | dagger | 0.21.9-r3 |
| Chainguard | datadog-agent-7.77 | no fix |
| Chainguard | datadog-agent-7.78 | no fix |
| Chainguard | datadog-agent-7.79 | no fix |
| Chainguard | datadog-agent-7.80 | no fix |
| Chainguard | datadog-agent-7.81 | no fix |
| Chainguard | datadog-agent-7.82 | no fix |
| Chainguard | datadog-agent-7.83 | no fix |
| Chainguard | datadog-agent-7.84 | 7.84.1-r1 |
| Chainguard | datadog-agent-fips-7.77 | no fix |
| Chainguard | datadog-agent-fips-7.78 | no fix |
| Chainguard | datadog-agent-fips-7.79 | 7.79.2-r16 |
| Chainguard | datadog-agent-fips-7.80 | 7.80.4-r19 |
| Chainguard | datadog-agent-fips-7.81 | 7.81.3-r10 |
| Chainguard | datadog-agent-fips-7.82 | 7.82.3-r6 |
| Chainguard | datadog-agent-fips-7.83 | 7.83.3-r2 |
| Chainguard | docker-cli-buildx | 0.37.1-r1 |
| Chainguard | docker-cli-buildx-fips | 0.37.1-r2 |
| Chainguard | docker-cli-buildx-fips | no fix |
| Chainguard | docker-compose | 5.5.1-r2 |
| Chainguard | docker-compose-fips | 5.5.1-r2 |
| Chainguard | dockerd-28 | no fix |
| Chainguard | dockerd-29 | 29.8.1-r1 |
| Chainguard | dockerd-fips-28 | no fix |
| Chainguard | dockerd-fips-29 | 29.8.1-r1 |
| Chainguard | dogstatsd-7.77 | no fix |
| Chainguard | dogstatsd-7.78 | no fix |
| Chainguard | dogstatsd-7.79 | no fix |
| Chainguard | dogstatsd-7.80 | no fix |
| Chainguard | dogstatsd-7.81 | no fix |
| Chainguard | dogstatsd-7.82 | no fix |
| Chainguard | dogstatsd-7.83 | no fix |
| Chainguard | dogstatsd-7.84 | 7.84.1-r1 |
| Chainguard | eksctl | no fix |
| Chainguard | envoy-gateway-1.6-egctl | 1.6.7-r15 |
| Chainguard | envoy-gateway-1.7-egctl | no fix |
| Chainguard | envoy-gateway-fips-1.6-egctl | 1.6.7-r20 |
| Chainguard | envoy-gateway-fips-1.7-egctl | 1.7.5-r28 |
| Chainguard | falco-no-driver | 0.45.0-r2 |
| Chainguard | filebeat-oss-7 | no fix |
| Chainguard | filebeat-oss-fips-7 | no fix |
| Chainguard | fuse-overlayfs-snapshotter | 2.1.7-r29 |
| Chainguard | fuse-overlayfs-snapshotter | no fix |
| Chainguard | gatekeeper-3.21-gator | 3.21.1-r25 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | no fix |
| Chainguard | gitlab-rails-ce-19.1 | no fix |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.7-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.3-r1 |
| Chainguard | gitlab-rails-ce-19.4 | 19.4.1-r1 |
| Chainguard | gitlab-rails-ce-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.11 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.0 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.7-r1 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.3-r1 |
| Chainguard | gitlab-rails-ce-fips-19.4 | 19.4.1-r1 |
| Chainguard | google-osconfig-agent | no fix |
| Chainguard | google-osconfig-agent | 20251028.00-r38 |
| Chainguard | grype | 0.119.0-r1 |
| Chainguard | grype-db | 0.54.3-r12 |
| Chainguard | grype-fips | 0.119.0-r1 |
| Chainguard | harvester | 1.9.0-r1 |
| Chainguard | harvester-fips | 1.9.0-r2 |
| Chainguard | harvester-fips-webhook | 1.9.0-r2 |
| Chainguard | harvester-webhook | 1.9.0-r1 |
| Chainguard | headlamp | 0.45.0-r8 |
| Chainguard | headlamp-fips | 0.45.0-r8 |
| Chainguard | helm-exporter | 1.3.0-r26 |
| Chainguard | helm-exporter-fips | 1.3.0-r25 |
| Chainguard | helm-mapkubeapis | 0.6.1-r34 |
| Chainguard | helm-operator | 1.42.3-r18 |
| Chainguard | helm-operator-fips | 1.42.3-r17 |
| Chainguard | helm-push | 0.11.1-r29 |
| Chainguard | helm-set-status | 0.3.0-r34 |
| Chainguard | k3s-1.31 | no fix |
| Chainguard | k3s-fips-1.33 | no fix |
| Chainguard | k3s-fips-1.34 | no fix |
| Chainguard | k3s-fips-1.35 | 1.35.9.1-r1 |
| Chainguard | k3s-fips-1.36 | 1.36.5.1-r3 |
| Chainguard | k3s-fips-1.37 | 1.37.1.1-r1 |
| Chainguard | k3s-static | 1.37.0.1-r1 |
| Chainguard | k3s-static-1.31 | no fix |
| Chainguard | k8sgpt | 0.4.39-r3 |
| Chainguard | k9s | 0.51.0-r22 |
| Chainguard | k9s-fips | 0.51.0-r24 |
| Chainguard | kaniko | 1.25.19-r7 |
| Chainguard | kaniko-fips | 1.25.19-r8 |
| Chainguard | kaniko-warmer | 1.25.19-r7 |
| Chainguard | kaniko-warmer-fips | 1.25.19-r8 |
| Chainguard | kargo-1.10 | 1.10.12-r4 |
| Chainguard | kargo-1.11 | 1.11.4-r3 |
| Chainguard | kargo-1.8 | no fix |
| Chainguard | kargo-1.8 | 1.8.16-r4 |
| Chainguard | kargo-1.9 | 1.9.12-r4 |
| Chainguard | kgateway-2.3 | no fix |
| Chainguard | kgateway-2.4 | 2.4.5-r2 |
| Chainguard | kgateway-fips-2.3 | 2.3.9-r2 |
| Chainguard | kgateway-fips-2.4 | 2.4.5-r2 |
| Chainguard | kube-arangodb-1.4 | 1.4.5-r6 |
| Chainguard | kube-arangodb-fips-1.4 | no fix |
| Chainguard | kube-mgmt | 11.0.12-r4 |
| Chainguard | kube-mgmt-fips | 11.0.12-r5 |
| Chainguard | kubescape | 4.0.14-r3 |
| Chainguard | kubescape-operator | 0.2.172-r4 |
| Chainguard | kubescape-operator-fips | 0.2.172-r4 |
| Chainguard | kubescape-server-downloader | 4.0.14-r2 |
| Chainguard | kubescape-server-fips | 4.0.14-r2 |
| Chainguard | kubescape-server-fips-downloader | 4.0.14-r2 |
| Chainguard | kubevela-vela-cli | 1.11.0-r17 |
| Chainguard | kubevela-vela-cli-fips | 1.11.0-r18 |
| Chainguard | kubevela-vela-core | 1.11.0-r17 |
| Chainguard | kubevela-vela-core-fips | 1.11.0-r18 |
| Chainguard | livekit-cli | 2.18.8-r1 |
| Chainguard | livekit-cli | no fix |
| Chainguard | manifest-tool | 2.2.2-r17 |
| Chainguard | nerdctl | 2.4.0-r1 |
| Chainguard | nerdctl-fips | 2.4.0-r1 |
| Chainguard | neuvector-controller | 5.6.2-r1 |
| Chainguard | neuvector-controller-fips | 5.6.2-r1 |
| Chainguard | neuvector-enforcer | 5.6.2-r1 |
| Chainguard | neuvector-enforcer-fips | 5.6.2-r1 |
| Chainguard | neuvector-scanner | 4.290-r1 |
| Chainguard | neuvector-scanner-fips | 4.290-r1 |
| Chainguard | neuvector-scanner-task | 4.290-r1 |
| Chainguard | neuvector-scanner-task-fips | no fix |
| Chainguard | neuvector-scanner-task-fips | 4.290-r1 |
| Chainguard | neuvector-upgrader | 5.6.2-r1 |
| Chainguard | neuvector-upgrader-fips | 5.6.2-r1 |
| Chainguard | newrelic-infrastructure-agent | 1.80.4-r1 |
| Chainguard | newrelic-infrastructure-agent-fips | 1.80.4-r1 |
| Chainguard | packer | 1.16.1-r1 |
| Chainguard | packer-fips | 1.16.1-r1 |
| Chainguard | rancher-2.10 | no fix |
| Chainguard | rancher-2.11 | no fix |
| Chainguard | rancher-2.12 | 2.12.14-r1 |
| Chainguard | rancher-2.13 | 2.13.10-r1 |
| Chainguard | rancher-2.14 | 2.14.6-r1 |
| Chainguard | rancher-agent-2.10 | no fix |
| Chainguard | rancher-agent-2.11 | no fix |
| Chainguard | rancher-agent-2.12 | 2.12.14-r1 |
| Chainguard | rancher-agent-2.13 | 2.13.10-r1 |
| Chainguard | rancher-agent-2.14 | 2.14.6-r1 |
| Chainguard | rancher-helm-3 | 3.20.0-r29 |
| Chainguard | redpanda-operator | 26.2.4-r1 |
| Chainguard | redpanda-operator-25.1 | 25.1.4-r24 |
| Chainguard | redpanda-operator-25.2 | 25.2.6-r19 |
| Chainguard | redpanda-operator-25.3 | 25.3.10-r1 |
| Chainguard | redpanda-operator-26.1 | 26.1.12-r1 |
| Chainguard | redpanda-operator-26.2 | 26.2.4-r1 |
| Chainguard | scorecard | 5.5.0-r24 |
| Chainguard | skaffold | 2.25.0-r3 |
| Chainguard | skaffold-fips | 2.25.0-r3 |
| Chainguard | spegel | 0.7.4-r12 |
| Chainguard | spegel-fips | 0.7.4-r11 |
| Chainguard | steampipe | 2.4.7-r2 |
| Chainguard | syft | 1.52.0-r2 |
| Chainguard | syft-fips | 1.52.0-r2 |
| Chainguard | teleport-17 | 17.7.29-r4 |
| Chainguard | teleport-18 | 18.11.1-r2 |
| Chainguard | tigera-operator-1.41 | 1.41.1-r29 |
| Chainguard | tigera-operator-fips-1.41 | 1.41.1-r27 |
| Chainguard | tracee | 0.24.1-r3 |
| Chainguard | tracee | no fix |
| Chainguard | tracee-fips | 0.24.1-r3 |
| Chainguard | trivy | 0.74.0-r9 |
| Chainguard | trivy-fips | 0.74.0-r8 |
| Chainguard | trivy-operator | 0.34.0-r7 |
| Chainguard | trivy-operator-fips | 0.34.0-r8 |
| Chainguard | upwind-agent | no fix |
| Chainguard | wolfictl | 0.39.27-r1 |
| Chainguard | xeol | 0.10.8-r64 |
| Chainguard | xeol-fips | 0.10.8-r61 |
| Chainguard | zarf | 0.86.0-r1 |
| Chainguard | zarf-fips | 0.86.0-r1 |
| Chainguard | zot | 2.1.21-r5 |
| Debian:12 | containerd | no fix |
| Debian:13 | containerd | no fix |
| Debian:14 | containerd | 2.1.9+ds1-5 |
| Ubuntu:22.04:LTS | containerd | no fix |
| Ubuntu:24.04:LTS | containerd-app | no fix |
| Ubuntu:26.04:LTS | containerd-app | no fix |
| Ubuntu:26.04:LTS | containerd-stable | no fix |
| Ubuntu:26.10 | containerd | no fix |
| Ubuntu:26.10 | containerd-app | no fix |
| Ubuntu:26.10 | containerd-stable | no fix |
| Ubuntu:Pro:16.04:LTS | containerd | no fix |
| Ubuntu:Pro:18.04:LTS | containerd | no fix |
| Ubuntu:Pro:20.04:LTS | containerd | no fix |
| Ubuntu:Pro:20.04:LTS | containerd-app | no fix |
| Ubuntu:Pro:22.04:LTS | containerd-app | no fix |
| Ubuntu:Pro:24.04:LTS | containerd | no fix |
| Ubuntu:Pro:26.04:LTS | containerd | no fix |
| Wolfi | buildctl | 0.33.0-r3 |
| Wolfi | buildkitd | 0.33.0-r3 |
| Wolfi | chartmuseum | 0.16.6-r8 |
| Wolfi | cluster-api-helm-controller | 0.6.4-r22 |
| Wolfi | dagger | 0.21.9-r3 |
| Wolfi | datadog-agent-7.77 | no fix |
| Wolfi | datadog-agent-7.78 | no fix |
| Wolfi | datadog-agent-7.79 | no fix |
| Wolfi | datadog-agent-7.80 | no fix |
| Wolfi | datadog-agent-7.81 | no fix |
| Wolfi | docker-cli-buildx | 0.37.1-r1 |
| Wolfi | docker-compose | 5.5.1-r2 |
| Wolfi | dockerd-28 | no fix |
| Wolfi | dockerd-29 | 29.8.1-r1 |
| Wolfi | dogstatsd-7.77 | no fix |
| Wolfi | dogstatsd-7.78 | no fix |
| Wolfi | dogstatsd-7.79 | no fix |
| Wolfi | dogstatsd-7.80 | no fix |
| Wolfi | dogstatsd-7.81 | no fix |
| Wolfi | eksctl | no fix |
| Wolfi | falco-no-driver | 0.45.0-r2 |
| Wolfi | fuse-overlayfs-snapshotter | 2.1.7-r29 |
| Wolfi | fuse-overlayfs-snapshotter | no fix |
| Wolfi | gatekeeper-3.21-gator | 3.21.1-r25 |
| Wolfi | grype | 0.119.0-r1 |
| Wolfi | headlamp | 0.45.0-r8 |
| Wolfi | helm-mapkubeapis | 0.6.1-r34 |
| Wolfi | helm-operator | 1.42.3-r18 |
| Wolfi | helm-push | 0.11.1-r29 |
| Wolfi | helm-set-status | 0.3.0-r34 |
| Wolfi | k3s-static | 1.37.0.1-r1 |
| Wolfi | k8sgpt | 0.4.39-r3 |
| Wolfi | k9s | 0.51.0-r22 |
| Wolfi | kaniko | 1.25.19-r7 |
| Wolfi | kaniko-warmer | 1.25.19-r7 |
| Wolfi | kargo-1.10 | 1.10.12-r4 |
| Wolfi | kube-arangodb-1.4 | 1.4.5-r6 |
| Wolfi | kubescape | 4.0.14-r3 |
| Wolfi | kubescape-operator | 0.2.172-r4 |
| Wolfi | kubevela-vela-cli | 1.11.0-r17 |
| Wolfi | kubevela-vela-core | 1.11.0-r17 |
| Wolfi | manifest-tool | 2.2.2-r17 |
| Wolfi | nerdctl | 2.4.0-r1 |
| Wolfi | neuvector-scanner | 4.290-r1 |
| Wolfi | neuvector-scanner-task | 4.290-r1 |
| Wolfi | newrelic-infrastructure-agent | 1.80.4-r1 |
| Wolfi | rancher-2.13 | 2.13.10-r1 |
| Wolfi | rancher-2.14 | 2.14.6-r1 |
| Wolfi | rancher-agent-2.13 | 2.13.10-r1 |
| Wolfi | rancher-agent-2.14 | 2.14.6-r1 |
| Wolfi | rancher-helm-3 | 3.20.0-r29 |
| Wolfi | scorecard | 5.5.0-r24 |
| Wolfi | skaffold | 2.25.0-r3 |
| Wolfi | spegel | 0.7.4-r12 |
| Wolfi | steampipe | 2.4.7-r2 |
| Wolfi | syft | 1.52.0-r2 |
| Wolfi | tigera-operator-1.41 | 1.41.1-r29 |
| Wolfi | trivy | 0.74.0-r9 |
| Wolfi | trivy-operator | 0.34.0-r7 |
| Wolfi | wolfictl | 0.39.27-r1 |
| Wolfi | xeol | 0.10.8-r64 |
| Wolfi | zarf | 0.86.0-r1 |
| Wolfi | zot | 2.1.21-r5 |
| openSUSE:Tumbleweed | elemental | 3.0.4-1.1 |