Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53495— containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service

Quick assessment

Affected
containerd containerd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

containerd 是一款开源容器运行时。在 1.7.35、2.0.12、2.2.8 和 2.3.5 之前的版本中，在启用了 CRI 插件的 Linux 系统上，当通过 exec 探针或生命周期钩子启动长期运行的后台子进程并保留标准输入/输出管道时，containerd 使用 CRI ExecSync 可能会导致 中的 协程无限期阻塞。输入和输出的排空阶段没有默认超时机制，且在请求上下文取消时也不会停止，因此重复调用 ExecSync 会累积阻塞的协程和主机内存。由此产生的资源耗尽可能触发 OOM 杀手终止 co

CVSS 6.8 · Medium

Affected Version Matrix 4

VendorProduct Version RangeStatus
containerd containerd < 1.7.35 affected
>= 2.0.0, < 2.0.12 affected
>= 2.2.0, < 2.2.8 affected
>= 2.3.0, < 2.3.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53495

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
containerd containerd < 1.7.35 -

II. Public POCs for CVE-2026-53495

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53495

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53495 (5)

Vendor Advisories for CVE-2026-53495 (1)

Vendor Pages for CVE-2026-53495 (3)

IV. Related Vulnerabilities

Same product: containerd
Same vendor: containerd
Same weakness: CWE-400

V. Comments for CVE-2026-53495

No comments yet

Leave a comment