Source: containerd Version: 2.1.9+ds1-3 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for containerd. CVE-2026-53493[0]: | containerd is an open-source container runtime. Prior to versions | 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph | can force very high CPU/memory usage during PullImage (before | container start), causing long ContainerCreating stalls and, at | larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, | 2.2.9, 2.3.6, and 2.4.1 fix the issue. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-53493 https://www.cve.org/CVERecord?id=CVE-2026-53493 [1] https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
