CVE-2026-53493

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53493
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53493.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53493
Aliases
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (487)
CLEANSTART (3)
DEBIAN (1)
ECHO (1)
MINI (438)
OESA (4)
openSUSE (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (1)
SUSE (2)
Published
2026-09-25T00:06:43Z
Modified
2026-10-28T12:11:55Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Containerd has image-pull DoS via crafted OCI index graph amplification
Details

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-770",
        "CWE-834"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53493.json"
}
References

Affected packages

Git / github.com/containerd/containerd

Affected ranges

Type
GIT
Repo
https://github.com/containerd/containerd
Events
Introduced
207ad711eabd375a01713109a8a197d197ff6542
Fixed
9a16faac5dcab011ad732d9b6fc678e0ae12fb2a
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2892c2042ee7fbd3be0e5bdc675e07b5acedb0bf
Introduced
061792f0ecf3684fb30a3a0eb006799b8c6638a7
Fixed
86634a5422440012fc33aeec903f53acfe68be3e
Introduced
2976f38ccbfcda5ef1364d63d60b0a304e4bf94a
Fixed
ee2735368117d2eb259779949d5e75cdafec9761
Introduced
a7fe631d96c08fb14cf8eff0afdc280e99c30a94
Last Affected
a7fe631d96c08fb14cf8eff0afdc280e99c30a94
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.0.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.7.36"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "2.1.0"
                },
                {
                    "fixed": "2.2.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "2.3.0"
                },
                {
                    "fixed": "2.3.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "= 2.4.0"
                },
                {
                    "last_affected": "= 2.4.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        }
    ]
}

Affected versions

0.*
0.0.2
0.0.3
0.0.4
0.0.5
= 2.*
= 2.4.0
api/v1.*
api/v1.10.0
api/v1.10.0-beta.0
api/v1.10.0-beta.1
api/v1.10.0-rc.0
api/v1.11.1
api/v1.6.0-beta.1
api/v1.6.0-beta.2
api/v1.6.0-beta.3
api/v1.7.19
v0.*
v0.2.0
v1.*
v1.0.0
v1.0.0-alpha0
v1.0.0-alpha1
v1.0.0-alpha2
v1.0.0-alpha3
v1.0.0-alpha4
v1.0.0-alpha5
v1.0.0-alpha6
v1.0.0-beta.0
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-rc.0
v1.1.0
v1.1.0-rc.0
v1.1.0-rc.1
v1.1.0-rc.2
v1.2.0
v1.2.0-beta.0
v1.2.0-beta.1
v1.2.0-beta.2
v1.2.0-rc.0
v1.2.0-rc.1
v1.2.0-rc.2
v1.3.0
v1.3.0-beta.0
v1.3.0-beta.1
v1.3.0-beta.2
v1.3.0-rc.0
v1.3.0-rc.1
v1.3.0-rc.2
v1.3.0-rc.3
v1.4.0
v1.4.0-beta.0
v1.4.0-beta.1
v1.4.0-beta.2
v1.4.0-rc.0
v1.4.0-rc.1
v1.5.0
v1.5.0-beta.0
v1.5.0-beta.1
v1.5.0-beta.2
v1.5.0-beta.3
v1.5.0-beta.4
v1.5.0-rc.0
v1.5.0-rc.1
v1.5.0-rc.2
v1.5.0-rc.3
v1.6.0
v1.6.0-beta.0
v1.6.0-beta.1
v1.6.0-beta.2
v1.6.0-beta.3
v1.6.0-beta.4
v1.6.0-beta.5
v1.6.0-rc.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.6.0-rc.3
v1.6.0-rc.4
v1.7.0
v1.7.0-beta.0
v1.7.0-beta.1
v1.7.0-beta.2
v1.7.0-beta.3
v1.7.0-beta.4
v1.7.0-rc.0
v1.7.0-rc.1
v1.7.0-rc.2
v1.7.0-rc.3
v1.7.1
v1.7.10
v1.7.11
v1.7.12
v1.7.13
v1.7.14
v1.7.15
v1.7.16
v1.7.17
v1.7.18
v1.7.19
v1.7.2
v1.7.20
v1.7.21
v1.7.22
v1.7.23
v1.7.24
v1.7.25
v1.7.26
v1.7.27
v1.7.28
v1.7.29
v1.7.3
v1.7.30
v1.7.31
v1.7.32
v1.7.33
v1.7.34
v1.7.35
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.2.0
v2.2.0-beta.0
v2.2.0-beta.1
v2.2.0-beta.2
v2.2.0-rc.0
v2.2.0-rc.1
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53493.json"