Source: containerd Version: 2.1.9+ds1-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for containerd. CVE-2026-53495[0]: | containerd is an open-source container runtime. Prior to 1.7.35, | 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin | enabled can indefinitely block the drainExecSyncIO goroutine in | internal/cri/server/container_execsync.go when CRI ExecSync is used | by exec probes or lifecycle hooks that launch long-lived background | child processes retaining standard input and output pipes. The input | and output drain phase has no default timeout and did not stop when | the request context was canceled, so repeated ExecSync invocations | can accumulate blocked goroutines and host memory. The resulting | resource exhaustion can cause the OOM killer to terminate | containerd, leaving the container runtime unavailable until restart. | Deployments not using containerd's CRI implementation and containers | not running on Linux are not affected. This issue is fixed in | versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-53495 https://www.cve.org/CVERecord?id=CVE-2026-53495 [1] https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv Please adjust the affected versions in the BTS as needed. Regards, Salvatore
