CVE-2026-53495
Fixed in a distro release EPSS <1%CVSS 6.8
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | 1.7.35 |
| Go | github.com/containerd/containerd/v2 | 2.0.12 |
| Go | github.com/containerd/containerd/v2 | 2.2.8 |
| Go | github.com/containerd/containerd/v2 | 2.3.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | amazon-ecs-agent | 1.106.2-r1 |
| Chainguard | amazon-ecs-agent-fips | 1.106.2-r1 |
| Chainguard | buildctl | 0.33.0-r2 |
| Chainguard | buildctl-fips | 0.33.0-r3 |
| Chainguard | buildkitd | 0.33.0-r2 |
| Chainguard | buildkitd-fips | 0.33.0-r3 |
| Chainguard | cg | 0.2.350-r0 |
| Chainguard | chainctl | 0.2.350-r0 |
| Chainguard | chainctl-fips | 0.2.349-r0 |
| Chainguard | chaos-mesh | 2.8.4-r6 |
| Chainguard | chaos-mesh-daemon | 2.8.4-r6 |
| Chainguard | chaos-mesh-dashboard | 2.8.4-r6 |
| Chainguard | chaos-mesh-fips | 2.8.4-r6 |
| Chainguard | chaos-mesh-fips-daemon | 2.8.4-r6 |
| Chainguard | chaos-mesh-fips-dashboard | 2.8.4-r6 |
| Chainguard | chartmuseum | 0.16.6-r6 |
| Chainguard | chartmuseum-fips | 0.16.6-r6 |
| Chainguard | cloudbeat-8.19 | 8.19.21-r3 |
| Chainguard | cloudbeat-9.2 | 9.2.8-r25 |
| Chainguard | cloudbeat-9.3 | 9.3.8-r12 |
| Chainguard | cloudbeat-9.4 | 9.4.7-r0 |
| Chainguard | cloudbeat-9.5 | 9.5.2-r5 |
| Chainguard | cloudbeat-fips-8.19 | 8.19.21-r3 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r24 |
| Chainguard | cloudbeat-fips-9.3 | 9.3.8-r10 |
| Chainguard | cloudbeat-fips-9.4 | 9.4.6-r4 |
| Chainguard | cloudbeat-fips-9.5 | 9.5.3-r4 |
| Chainguard | cluster-api-helm-controller | 0.6.4-r19 |
| Chainguard | cluster-api-helm-controller-fips | 0.6.4-r19 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r4 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r4 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r4 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r4 |
| Chainguard | consul-k8s-1.1-cli | 1.1.18-r57 |
| Chainguard | consul-k8s-1.3-cli | 1.3.9-r62 |
| Chainguard | consul-k8s-1.4-cli | 1.4.10-r43 |
| Chainguard | consul-k8s-1.5-cli | 1.5.9-r44 |
| Chainguard | consul-k8s-1.6-cli | 1.6.10-r37 |
| Chainguard | consul-k8s-1.7-cli | 1.7.13-r26 |
| Chainguard | consul-k8s-fips-1.1-cli | 1.1.18-r50 |
| Chainguard | consul-k8s-fips-1.3-cli | 1.3.9-r54 |
| Chainguard | consul-k8s-fips-1.4-cli | 1.4.10-r43 |
| Chainguard | consul-k8s-fips-1.5-cli | 1.5.9-r44 |
| Chainguard | consul-k8s-fips-1.6-cli | 1.6.10-r37 |
| Chainguard | consul-k8s-fips-1.7-cli | 1.7.13-r29 |
| Chainguard | crossplane-cli-2.3 | 2.3.4-r14 |
| Chainguard | crossplane-cli-2.4 | 2.4.1-r6 |
| Chainguard | crossplane-cli-fips-2.3 | 2.3.4-r13 |
| Chainguard | crossplane-cli-fips-2.4 | 2.4.1-r6 |
| Chainguard | dagger | 0.21.9-r1 |
| Chainguard | datadog-agent-7.76 | 7.76.3-r41 |
| Chainguard | datadog-agent-7.77 | no fix |
| Chainguard | datadog-agent-7.78 | 7.78.4-r20 |
| Chainguard | datadog-agent-7.79 | 7.79.2-r18 |
| Chainguard | datadog-agent-7.80 | 7.80.4-r15 |
| Chainguard | datadog-agent-7.80-core-integrations | 7.80.4-r16 |
| Chainguard | datadog-agent-7.80-oci-compat | no fix |
| Chainguard | datadog-agent-7.80-s6-overlay | no fix |
| Chainguard | datadog-agent-7.81 | 7.81.3-r5 |
| Chainguard | datadog-agent-7.82 | no fix |
| Chainguard | datadog-agent-7.83 | 7.83.3-r1 |
| Chainguard | datadog-agent-fips-7.76 | 7.76.3-r42 |
| Chainguard | datadog-agent-fips-7.77 | no fix |
| Chainguard | datadog-agent-fips-7.78 | 7.78.4-r18 |
| Chainguard | datadog-agent-fips-7.79 | 7.79.2-r13 |
| Chainguard | datadog-agent-fips-7.80 | 7.80.4-r16 |
| Chainguard | datadog-agent-fips-7.81 | 7.81.3-r7 |
| Chainguard | datadog-agent-fips-7.81 | 7.81.3-r6 |
| Chainguard | datadog-agent-fips-7.82 | 7.82.3-r6 |
| Chainguard | datadog-agent-fips-7.83 | 7.83.2-r1 |
| Chainguard | datadog-cluster-agent-7.81 | no fix |
| Chainguard | docker-cli-buildx | 0.37.0-r2 |
| Chainguard | docker-cli-buildx-fips | 0.37.0-r3 |
| Chainguard | docker-compose | 5.5.1-r1 |
| Chainguard | docker-compose-fips | 5.5.1-r1 |
| Chainguard | dockerd-29 | 29.8.0-r1 |
| Chainguard | dockerd-fips-29 | 29.8.0-r1 |
| Chainguard | dogstatsd-7.76 | 7.76.3-r41 |
| Chainguard | dogstatsd-7.77 | no fix |
| Chainguard | dogstatsd-7.78 | 7.78.4-r20 |
| Chainguard | dogstatsd-7.79 | 7.79.2-r18 |
| Chainguard | dogstatsd-7.80 | 7.80.4-r15 |
| Chainguard | dogstatsd-7.81 | 7.81.3-r5 |
| Chainguard | dogstatsd-7.82 | no fix |
| Chainguard | dogstatsd-7.83 | 7.83.3-r1 |
| Chainguard | eksctl | 0.230.0-r7 |
| Chainguard | envoy-gateway-1.6-egctl | 1.6.7-r14 |
| Chainguard | envoy-gateway-1.7-egctl | 1.7.5-r35 |
| Chainguard | envoy-gateway-fips-1.6-egctl | 1.6.7-r18 |
| Chainguard | envoy-gateway-fips-1.7-egctl | 1.7.5-r27 |
| Chainguard | filebeat-oss-7 | 0 |
| Chainguard | filebeat-oss-fips-7 | no fix |
| Chainguard | fuse-overlayfs-snapshotter | 2.1.7-r28 |
| Chainguard | gatekeeper-3.21-gator | 3.21.1-r23 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | no fix |
| Chainguard | gitlab-rails-ce-19.1 | no fix |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.6-r8 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.2-r3 |
| Chainguard | gitlab-rails-ce-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.11 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.0 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.6-r5 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.2-r1 |
| Chainguard | google-osconfig-agent | 20251028.00-r36 |
| Chainguard | grype | 0.118.0-r4 |
| Chainguard | grype-db | 0.54.3-r10 |
| Chainguard | grype-fips | 0.118.0-r6 |
| Chainguard | harvester | 1.8.2-r9 |
| Chainguard | harvester-fips | 1.8.2-r6 |
| Chainguard | harvester-fips-webhook | 1.8.2-r6 |
| Chainguard | harvester-webhook | 1.8.2-r9 |
| Chainguard | headlamp | 0.45.0-r6 |
| Chainguard | headlamp-fips | 0.45.0-r6 |
| Chainguard | helm-3 | 3.22.0-r0 |
| Chainguard | helm-exporter | 1.3.0-r24 |
| Chainguard | helm-exporter-fips | 1.3.0-r23 |
| Chainguard | helm-mapkubeapis | 0.6.1-r32 |
| Chainguard | helm-operator | 1.42.3-r16 |
| Chainguard | helm-operator-fips | 1.42.3-r15 |
| Chainguard | helm-push | 0.11.1-r27 |
| Chainguard | helm-set-status | 0.3.0-r32 |
| Chainguard | k3s-1.31 | no fix |
| Chainguard | k3s-fips-1.33 | no fix |
| Chainguard | k3s-fips-1.34 | no fix |
| Chainguard | k3s-fips-1.35 | 1.35.9.1-r1 |
| Chainguard | k3s-fips-1.36 | 1.36.5.1-r3 |
| Chainguard | k3s-fips-1.37 | 1.37.1.1-r1 |
| Chainguard | k3s-static | 1.37.0.1-r1 |
| Chainguard | k3s-static-1.31 | no fix |
| Chainguard | k8sgpt | 0.4.38-r3 |
| Chainguard | k8ssandra-client | 0.9.1-r2 |
| Chainguard | k9s | 0.51.0-r19 |
| Chainguard | k9s-fips | 0.51.0-r21 |
| Chainguard | kaniko | 1.25.19-r5 |
| Chainguard | kaniko-fips | 1.25.19-r6 |
| Chainguard | kaniko-warmer | 1.25.19-r5 |
| Chainguard | kaniko-warmer-fips | 1.25.19-r6 |
| Chainguard | kargo-1.10 | 1.10.12-r2 |
| Chainguard | kargo-1.11 | 1.11.4-r2 |
| Chainguard | kargo-1.8 | 1.8.16-r1 |
| Chainguard | kargo-1.9 | 1.9.12-r2 |
| Chainguard | kgateway-2.3 | 2.3.8-r4 |
| Chainguard | kgateway-2.4 | 2.4.4-r4 |
| Chainguard | kgateway-fips-2.3 | 2.3.8-r4 |
| Chainguard | kgateway-fips-2.4 | 2.4.4-r5 |
| Chainguard | kube-arangodb-1.4 | 1.4.5-r3 |
| Chainguard | kube-arangodb-fips-1.4 | 1.4.5-r4 |
| Chainguard | kube-mgmt | 11.0.12-r2 |
| Chainguard | kube-mgmt-fips | 11.0.12-r3 |
| Chainguard | kubescape | 4.0.12-r14 |
| Chainguard | kubescape-operator | 0.2.172-r2 |
| Chainguard | kubescape-operator-fips | 0.2.172-r2 |
| Chainguard | kubescape-server | 4.0.12-r14 |
| Chainguard | kubescape-server-downloader | 4.0.12-r14 |
| Chainguard | kubescape-server-fips | 4.0.12-r13 |
| Chainguard | kubescape-server-fips-downloader | 4.0.12-r13 |
| Chainguard | kubevela-vela-cli | 1.11.0-r15 |
| Chainguard | kubevela-vela-cli-fips | 1.11.0-r16 |
| Chainguard | kubevela-vela-core | 1.11.0-r15 |
| Chainguard | kubevela-vela-core-fips | 1.11.0-r16 |
| Chainguard | livekit-cli | 2.18.6-r1 |
| Chainguard | manifest-tool | 2.2.2-r15 |
| Chainguard | nerdctl | 2.3.5-r14 |
| Chainguard | nerdctl-fips | 2.3.5-r11 |
| Chainguard | neuvector-controller | 5.6.1-r8 |
| Chainguard | neuvector-controller-fips | 5.6.1-r6 |
| Chainguard | neuvector-enforcer | 5.6.1-r8 |
| Chainguard | neuvector-enforcer-fips | 5.6.1-r6 |
| Chainguard | neuvector-scanner-fips | 4.276-r0 |
| Chainguard | neuvector-scanner-task | 4.274-r1 |
| Chainguard | neuvector-scanner-task-fips | 4.276-r0 |
| Chainguard | neuvector-upgrader | 5.6.1-r8 |
| Chainguard | neuvector-upgrader-fips | 5.6.1-r6 |
| Chainguard | newrelic-infrastructure-agent | 1.80.3-r2 |
| Chainguard | newrelic-infrastructure-agent-fips | 1.80.3-r2 |
| Chainguard | packer | 1.16.0-r12 |
| Chainguard | packer-fips | 1.16.0-r10 |
| Chainguard | rancher-2.10 | no fix |
| Chainguard | rancher-2.11 | no fix |
| Chainguard | rancher-2.12 | 2.12.13-r6 |
| Chainguard | rancher-2.13 | 2.13.9-r7 |
| Chainguard | rancher-2.14 | 2.14.5-r6 |
| Chainguard | rancher-agent-2.10 | no fix |
| Chainguard | rancher-agent-2.11 | no fix |
| Chainguard | rancher-agent-2.12 | 2.12.13-r6 |
| Chainguard | rancher-agent-2.13 | 2.13.9-r4 |
| Chainguard | rancher-agent-2.14 | 2.14.5-r6 |
| Chainguard | rancher-helm-3 | 3.20.0-r27 |
| Chainguard | redpanda-operator | 26.2.3-r1 |
| Chainguard | redpanda-operator-25.1 | 25.1.4-r21 |
| Chainguard | redpanda-operator-25.2 | 25.2.6-r16 |
| Chainguard | redpanda-operator-25.3 | 25.3.9-r1 |
| Chainguard | redpanda-operator-26.1 | 26.1.11-r1 |
| Chainguard | redpanda-operator-26.2 | 26.2.3-r1 |
| Chainguard | scorecard | 5.5.0-r22 |
| Chainguard | skaffold | 2.24.0-r11 |
| Chainguard | skaffold-fips | 2.24.0-r11 |
| Chainguard | spegel | 0.7.4-r11 |
| Chainguard | spegel-fips | 0.7.4-r10 |
| Chainguard | steampipe | 2.4.6-r2 |
| Chainguard | syft | 1.51.1-r4 |
| Chainguard | syft-fips | 1.51.1-r7 |
| Chainguard | teleport-17 | 17.7.29-r2 |
| Chainguard | teleport-18 | 18.11.0-r8 |
| Chainguard | tigera-operator-1.41 | 1.41.1-r27 |
| Chainguard | tigera-operator-fips-1.41 | 1.41.1-r25 |
| Chainguard | trivy | 0.74.0-r7 |
| Chainguard | trivy-fips | 0.74.0-r6 |
| Chainguard | trivy-operator | 0.34.0-r5 |
| Chainguard | trivy-operator-fips | 0.34.0-r6 |
| Chainguard | upwind-agent | no fix |
| Chainguard | wolfictl | 0.39.25-r7 |
| Chainguard | xeol | 0.10.8-r60 |
| Chainguard | xeol-fips | 0.10.8-r58 |
| Chainguard | zarf | 0.85.0-r3 |
| Chainguard | zarf-fips | 0.85.0-r4 |
| Chainguard | zot | 2.1.21-r2 |
| Debian:12 | containerd | no fix |
| Debian:13 | containerd | no fix |
| Debian:14 | containerd | 2.1.9+ds1-4 |
| SUSE:Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| Ubuntu:22.04:LTS | containerd | no fix |
| Ubuntu:24.04:LTS | containerd-app | no fix |
| Ubuntu:26.04:LTS | containerd-app | no fix |
| Ubuntu:26.04:LTS | containerd-stable | no fix |
| Ubuntu:26.10 | containerd | no fix |
| Ubuntu:26.10 | containerd-app | no fix |
| Ubuntu:26.10 | containerd-stable | no fix |
| Ubuntu:Pro:16.04:LTS | containerd | no fix |
| Ubuntu:Pro:18.04:LTS | containerd | no fix |
| Ubuntu:Pro:20.04:LTS | containerd | no fix |
| Ubuntu:Pro:20.04:LTS | containerd-app | no fix |
| Ubuntu:Pro:22.04:LTS | containerd-app | no fix |
| Ubuntu:Pro:24.04:LTS | containerd | no fix |
| Ubuntu:Pro:26.04:LTS | containerd | no fix |
| Wolfi | buildctl | 0.33.0-r2 |
| Wolfi | buildkitd | 0.33.0-r2 |
| Wolfi | chartmuseum | 0.16.6-r6 |
| Wolfi | cluster-api-helm-controller | 0.6.4-r19 |
| Wolfi | dagger | 0.21.9-r1 |
| Wolfi | datadog-agent-7.76 | 7.76.3-r41 |
| Wolfi | datadog-agent-7.77 | no fix |
| Wolfi | datadog-agent-7.78 | 7.78.4-r20 |
| Wolfi | datadog-agent-7.79 | 7.79.2-r18 |
| Wolfi | datadog-agent-7.80 | 7.80.4-r15 |
| Wolfi | datadog-agent-7.80-core-integrations | 7.80.4-r16 |
| Wolfi | datadog-agent-7.80-oci-compat | no fix |
| Wolfi | datadog-agent-7.80-s6-overlay | no fix |
| Wolfi | datadog-agent-7.81 | 7.81.3-r5 |
| Wolfi | datadog-cluster-agent-7.81 | no fix |
| Wolfi | docker-cli-buildx | 0.37.0-r2 |
| Wolfi | docker-compose | 5.5.1-r1 |
| Wolfi | dockerd-29 | 29.8.0-r1 |
| Wolfi | dogstatsd-7.76 | 7.76.3-r41 |
| Wolfi | dogstatsd-7.77 | no fix |
| Wolfi | dogstatsd-7.78 | 7.78.4-r20 |
| Wolfi | dogstatsd-7.79 | 7.79.2-r18 |
| Wolfi | dogstatsd-7.80 | 7.80.4-r15 |
| Wolfi | dogstatsd-7.81 | 7.81.3-r5 |
| Wolfi | eksctl | 0.230.0-r7 |
| Wolfi | fuse-overlayfs-snapshotter | 2.1.7-r28 |
| Wolfi | gatekeeper-3.21-gator | 3.21.1-r23 |
| Wolfi | grype | 0.118.0-r4 |
| Wolfi | headlamp | 0.45.0-r6 |
| Wolfi | helm-3 | 3.22.0-r0 |
| Wolfi | helm-mapkubeapis | 0.6.1-r32 |
| Wolfi | helm-operator | 1.42.3-r16 |
| Wolfi | helm-push | 0.11.1-r27 |
| Wolfi | helm-set-status | 0.3.0-r32 |
| Wolfi | k3s-static | 1.37.0.1-r1 |
| Wolfi | k8sgpt | 0.4.38-r3 |
| Wolfi | k8ssandra-client | 0.9.1-r2 |
| Wolfi | k9s | 0.51.0-r19 |
| Wolfi | kaniko | 1.25.19-r5 |
| Wolfi | kaniko-warmer | 1.25.19-r5 |
| Wolfi | kargo-1.10 | 1.10.12-r2 |
| Wolfi | kube-arangodb-1.4 | 1.4.5-r3 |
| Wolfi | kubescape | 4.0.12-r14 |
| Wolfi | kubescape-operator | 0.2.172-r2 |
| Wolfi | kubevela-vela-cli | 1.11.0-r15 |
| Wolfi | kubevela-vela-core | 1.11.0-r15 |
| Wolfi | manifest-tool | 2.2.2-r15 |
| Wolfi | nerdctl | 2.3.5-r14 |
| Wolfi | neuvector-scanner-task | 4.274-r1 |
| Wolfi | newrelic-infrastructure-agent | 1.80.3-r2 |
| Wolfi | rancher-2.13 | 2.13.9-r7 |
| Wolfi | rancher-2.14 | 2.14.5-r6 |
| Wolfi | rancher-agent-2.13 | 2.13.9-r4 |
| Wolfi | rancher-agent-2.14 | 2.14.5-r6 |
| Wolfi | rancher-helm-3 | 3.20.0-r27 |
| Wolfi | scorecard | 5.5.0-r22 |
| Wolfi | skaffold | 2.24.0-r11 |
| Wolfi | spegel | 0.7.4-r11 |
| Wolfi | steampipe | 2.4.6-r2 |
| Wolfi | syft | 1.51.1-r4 |
| Wolfi | tigera-operator-1.41 | 1.41.1-r27 |
| Wolfi | trivy | 0.74.0-r7 |
| Wolfi | trivy-operator | 0.34.0-r5 |
| Wolfi | wolfictl | 0.39.25-r7 |
| Wolfi | xeol | 0.10.8-r60 |
| Wolfi | zarf | 0.85.0-r3 |
| Wolfi | zot | 2.1.21-r2 |
| openSUSE:Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| openSUSE:Leap 16.0 | hauler | 2.1.1-bp160.1.1 |
| openSUSE:Leap 16.0 | trivy | 0.74.0-160000.3.1 |
| openSUSE:Tumbleweed | hauler | 2.1.0-4.1 |
| openSUSE:Tumbleweed | trivy | 0.75.0-1.1 |