CVE-2026-53495 containerd CVE debrief

Who should care

Defenders responsible for containerized environments using containerd on Linux should assess exposure and prioritize updating to fixed versions. This includes verifying containerd versions and updating to 1.7.35, 2.0.12, 2.2.8, or 2.3.5. Assess exposure for Linux deployments using containerd's CRI plugin and monitor for potential resource exhaustion and OOM killer termination of containerd.

Why it matters

CVE-2026-53495 is a medium-severity vulnerability in containerd that can cause resource exhaustion and disrupt container runtime availability. Defenders should prioritize verifying containerd versions and updating to fixed versions.

• Potential resource exhaustion and OOM killer termination of containerd
• Disruption of container runtime availability until restart
• Need for verification of containerd versions and exposure assessment

Technical summary

CVE-2026-53495 is a vulnerability in containerd that can cause indefinite blocking of the drainExecSyncIO goroutine, leading to resource exhaustion and potential OOM killer termination of containerd. This issue affects Linux deployments using containerd's CRI plugin. The vulnerability allows long-lived background child processes to retain standard input and output pipes, causing the input and output drain phase to have no default timeout and not stop when the request context is canceled. Repeated ExecSync invocations can accumulate blocked goroutines and host memory.

Defensive priority

Defenders should prioritize verifying containerd versions and updating to fixed versions 1.7.35, 2.0.12, 2.2.8, or 2.3.5. Assess exposure for Linux deployments using containerd's CRI plugin.

Recommended defensive actions

• Verify containerd versions and update to 1.7.35, 2.0.12, 2.2.8, or 2.3.5
• Assess exposure for Linux deployments using containerd's CRI plugin
• Monitor for potential resource exhaustion and OOM killer termination of containerd
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is fixed in containerd versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. The vulnerability can cause resource exhaustion and disrupt container runtime availability until restart. Defenders should verify containerd versions and update to fixed versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.