Your message dated Sat, 03 Oct 2026 14:24:17 +0000
with message-id <[email protected]>
and subject line Bug#1148180: fixed in containerd 2.1.9+ds1-4
has caused the Debian Bug report #1148180,
regarding containerd: CVE-2026-53495
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148180: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148180
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: containerd
Version: 2.1.9+ds1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for containerd.
CVE-2026-53495[0]:
| containerd is an open-source container runtime. Prior to 1.7.35,
| 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin
| enabled can indefinitely block the drainExecSyncIO goroutine in
| internal/cri/server/container_execsync.go when CRI ExecSync is used
| by exec probes or lifecycle hooks that launch long-lived background
| child processes retaining standard input and output pipes. The input
| and output drain phase has no default timeout and did not stop when
| the request context was canceled, so repeated ExecSync invocations
| can accumulate blocked goroutines and host memory. The resulting
| resource exhaustion can cause the OOM killer to terminate
| containerd, leaving the container runtime unavailable until restart.
| Deployments not using containerd's CRI implementation and containers
| not running on Linux are not affected. This issue is fixed in
| versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-53495
https://www.cve.org/CVERecord?id=CVE-2026-53495
[1]
https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: containerd
Source-Version: 2.1.9+ds1-4
Done: Reinhard Tartler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
containerd, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Reinhard Tartler <[email protected]> (supplier of updated containerd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 02 Oct 2026 17:38:11 -0400
Source: containerd
Architecture: source
Version: 2.1.9+ds1-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Reinhard Tartler <[email protected]>
Closes: 1148180
Changes:
containerd (2.1.9+ds1-4) unstable; urgency=medium
.
[ Marcos Talau ]
* Enable Salsa CI using default template
.
[ Reinhard Tartler ]
* restore original salsa pipeline definition
* debian/lrc.config: ignore false-positive dual-license discrepancies
* d/patches: backport upstream fix for CVE-2026-53495 (Closes: #1148180)
Checksums-Sha1:
6d464fe8a509005b2c35b52df0734106aa51f533 5720 containerd_2.1.9+ds1-4.dsc
44127fe502b6a33c5dda0f0642b3c57d19c74584 798680
containerd_2.1.9+ds1-4.debian.tar.xz
Checksums-Sha256:
b798ca4bccf4e0522163e26619b3ba42bd7e92048e2f1f01a2d53c49ec27296f 5720
containerd_2.1.9+ds1-4.dsc
462132e98e9794b86aa9a9b8e883e6f0ca0bae1a6ebda5b1f8232215aab85c0b 798680
containerd_2.1.9+ds1-4.debian.tar.xz
Files:
94ae084d9f4cbfba7411e90dbb3f1cd4 5720 admin optional containerd_2.1.9+ds1-4.dsc
e70c46646b4b1a9ed15e79f6016c8f40 798680 admin optional
containerd_2.1.9+ds1-4.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmrBC8QUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJsspmBAA0JfWhHA7x1SpL1ZBp1Hbc39Eo6Ji
jbHhwSajOR7PPkq8H3HsCasA8vAxuDonugV8HeYyYpsxaKPMmEOr/EfJe/pVJW9E
H1x7y63ni67mijo7LZ826ccIT1PQ0tGtber+m+jXEXxEQucP653fBsyTN0me19JC
Gz/Oj89U4vzFH7RddPfS50AfcWWnoFm7bhmL2uS80k09DjbLL+raK8I5rQ6zJXdB
0NuR4satkgGO98CT4xbipJXxE7k3hkcYPZPIsyQS5lH5IZ8rjA0UtWnDL6yrRn8Q
BUGZMCC2O28/tnl74icbN2YNpGaQSoxxrgNdO+Py0my38XnurzMETW0KFG/Pg9dd
cUtQB0FhDRdfB2ZQPmXChWJ6L9vtlhblBORPqIW+KslYyvoIBtc24Nbvcm42A/oO
rqH0+ntaX0meP4whBLGQzdJP+a2Tgy+n2Cs7REa2JrAaj64sRaNGmtjay2NJoCyr
9oqoHEdvCt032/ukBBJa9kPy4bm0ur2nyG1ZHNgtFZc/AnCYJrvYQMEVp/xHWVoq
rKnLMKfRA9jzYxk0wralf1mi4CM8Wspm50ghK9+jbRUDNawbVJ2D+9X75lZz9S0o
vmikP8M8Ft0ckBNhFefJXprlqIUnIBkRkNPteTazr8ZyPBmXKhzTQsNemO9xvcLd
TQfNWTARRhmJWjw=
=s2I2
-----END PGP SIGNATURE-----
pgpJtaM8TNkvW.pgp
Description: PGP signature
--- End Message ---
