DEBIAN-CVE-2026-53495

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-53495
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53495.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-53495
Upstream
Published
2026-09-14T18:17:51Z
Modified
2026-09-16T09:00:15Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

References

Affected packages

Debian:12 / containerd

Package

Name
containerd
Purl
pkg:deb/debian/containerd?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.20~ds1-1
1.6.20~ds1-1+deb12u1
1.6.20~ds1-1+deb12u2
1.6.20~ds1-1+deb12u3
1.6.20~ds1-2
1.6.24~ds1-1
1.6.24~ds1-2
1.7.18~ds1-1
1.7.18~ds1-2
1.7.18~ds1-3
1.7.18~ds1-4
1.7.18~ds1-5
1.7.18~ds1-6
1.7.18~ds2-1
1.7.20~ds2-1
1.7.20~ds2-2
1.7.21~ds2-1
1.7.22~ds1-1
1.7.23~ds1-1
1.7.23~ds1-2
1.7.23~ds1-3
1.7.23~ds2-1
1.7.24~ds1-1
1.7.24~ds1-2
1.7.24~ds1-3
1.7.24~ds1-4
1.7.24~ds1-5
1.7.24~ds1-6
1.7.24~ds1-7
1.7.24~ds1-8
1.7.24~ds1-9
1.7.24~ds1-10
2.*
2.1.4~ds2-2
2.1.4~ds2-3
2.1.4~ds2-4
2.1.4~ds2-5
2.1.4~ds2-6
2.1.4~ds2-7
2.1.4~ds2-8
2.1.6+ds1-1
2.1.9+ds1-1
2.1.9+ds1-2
2.1.9+ds1-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53495.json"

Debian:13 / containerd

Package

Name
containerd
Purl
pkg:deb/debian/containerd?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.7.24~ds1-6
1.7.24~ds1-6+deb13u1
1.7.24~ds1-7
1.7.24~ds1-8
1.7.24~ds1-9
1.7.24~ds1-10
2.*
2.1.4~ds2-2
2.1.4~ds2-3
2.1.4~ds2-4
2.1.4~ds2-5
2.1.4~ds2-6
2.1.4~ds2-7
2.1.4~ds2-8
2.1.6+ds1-1
2.1.9+ds1-1
2.1.9+ds1-2
2.1.9+ds1-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53495.json"

Debian:14 / containerd

Package

Name
containerd
Purl
pkg:deb/debian/containerd?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.7.24~ds1-6
1.7.24~ds1-7
1.7.24~ds1-8
1.7.24~ds1-9
1.7.24~ds1-10
2.*
2.1.4~ds2-2
2.1.4~ds2-3
2.1.4~ds2-4
2.1.4~ds2-5
2.1.4~ds2-6
2.1.4~ds2-7
2.1.4~ds2-8
2.1.6+ds1-1
2.1.9+ds1-1
2.1.9+ds1-2
2.1.9+ds1-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-53495.json"