CVE-2026-53495 containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

EUVD-2026-77684

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-53495 containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

CVE-2026-53495

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/containerexecsync.go when CRI ExecSync is used by exec probes or lifecycle hooks...

OESA-2026-3719 containerd security update

containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

OPENSUSE-SU-2026:21835-1 Security update for trivy

This update for trivy fixes the following issues: - CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service bsc1280111. - CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key authentication callbacks can cau...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. A bug was discovered in Containerd prior to versions 1.6.18 and 1.5.18, where supplementary groups were not set up properly within a container. If an attacker has direct access to a container and manipulates the supplementary group permissions, they...

Astra Linux – Vulnerability in containerd-app

Containerd is an open-source container runtime. A bug was discovered in Containerd prior to versions 1.6.38, 1.7.27, and 2.0.4. In these versions, containers launched with a User set as UID:GID that exceeded the maximum 32-bit signed integer could cause an overflow condition, resulting in the...

Astra Linux – Vulnerability in Containerd

In containerd a industry-standard container runtime, before versions 1.3.10 and 1.4.4, containers launched through containerd’s CRI implementation via Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service that share the same image might receive incorrect...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime that emphasizes simplicity, robustness, and portability. A bug was discovered in Containerd where container root directories and certain plugins had insufficiently restricted permissions, allowing unprivileged Linux users to access the contents of...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. Prior to versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where no limit was applied could cause a denial of service. This bug ha...

Astra Linux – Vulnerability in Containerd

Containerd is a container runtime that is available as a daemon for Linux and Windows. A bug was discovered in Containerd prior to versions 1.6.1, 1.5.10, and 1.14.12. In these versions, containers launched through Containerd’s CRI implementation on Linux, with a specially crafted image...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. A bug was discovered in Containerd’s CRI implementation, where a user could exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user’s process fails to launch d...

Astra Linux – Vulnerability in containerd-app

Due to a missing nil check, sending HTTP/2 frames with values 0x0a-0x0f will cause a running server to panic...

Astra Linux – Vulnerability in Containerd

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was discovered in Moby Docker Engine prior to version 20.10.14, where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. A bug was discovered in the CRI implementation of Containerd, where programs within a container can cause the Containerd daemon to consume memory indefinitely during the invocation of the ExecSync API. This can result in Containerd consuming all...

Astra Linux – Vulnerability in containerd-app

Containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4, and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer were incorrectly treated as a username, resulting in the evasion of the Kubernetes “runAsNonRoot”...

Astra Linux – Vulnerability in Containerd

Containerd is a container runtime. A bug was discovered in containerd versions prior to 1.4.8 and 1.5.4, where pulling and extracting a specially crafted container image could result in changes to Unix file permissions for existing files in the host’s filesystem. Changes to file permissions could...

Amazon Linux 2023 : nerdctl (ALAS2023-2026-2129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2129 advisory. A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such...