https://vulnerability.circl.lu/sightings/feed 2026-09-26T11:47:21.890603+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/0cb5c622-d9eb-49ed-bc52-46dc60a3fcea/export 2026-09-26T11:47:21.911241+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0cb5c622-d9eb-49ed-bc52-46dc60a3fcea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://gist.github.com/alon710/a28d447f907845848dd908acc002c8d7", "content": "# CVE-2026-53493: CVE-2026-53493: Uncontrolled Resource Consumption in containerd Image-Pull Descriptor Graph Resolution\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53493\n\n## Summary\ncontainerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. The vulnerability occurs because containerd's image-pull descriptor graph resolution handlers processed OCI image indices and manifests recursively without enforcing boundaries on traversal depth or breadth, and without maintaining a global visited registry to count duplicate references.\n\n## TL;DR\nA crafted OCI index graph can force high CPU and memory usage during image pulls in containerd, leading to Denial of Service (DoS) and node instability.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-53493\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **Privileges Required**: None\n- **CVSS Score**: 6.9\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- containerd\n- **containerd**: < 1.7.36 (Fixed in: `1.7.36`)\n- **containerd**: >= 2.0.0, < 2.0.13 (Fixed in: `2.0.13`)\n- **containerd**: >= 2.2.0, < 2.2.9 (Fixed in: `2.2.9`)\n- **containerd**: >= 2.3.0, < 2.3.6 (Fixed in: `2.3.6`)\n- **containerd**: >= 2.4.0, < 2.4.1 (Fixed in: `2.4.1`)\n\n## Mitigation\n\n- Upgrade containerd to a patched release (1.7.36, 2.0.13, 2.2.9, 2.3.6, or 2.4.1).\n- Configure private registries and restrict pulls to trusted image sources.\n- Implement admission control mechanisms to block untrusted images.\n\n**Remediation Steps:**\n1. Identify affected nodes running vulnerable versions of containerd.\n2. Apply the update package via the operating system package manager or cluster management manifests.\n3. Restart the containerd service to load the patched runtime.\n4. Verify the installation version by running 'containerd --version'.\n\n## References\n\n- [NVD - CVE-2026-53493](https://nvd.nist.gov/vuln/detail/CVE-2026-53493)\n- [GitHub Security Advisory GHSA-pg57-6jwg-q645](https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645)\n- [CVE.org - CVE-2026-53493](https://www.cve.org/CVERecord?id=CVE-2026-53493)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53493) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T06:30:31.000000Z"} 2026-09-26T06:30:31+00:00 https://vulnerability.circl.lu/sighting/c00c94ad-a29b-42c5-b034-b370b22490c7/export 2026-09-26T11:47:21.913612+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c00c94ad-a29b-42c5-b034-b370b22490c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwclzrgv7s2f", "content": "containerd patched CVE-2026-53493: a crafted image can pin a node's CPU and memory during the pull, before any container runs.\n\nModerate, not yet exploited.\n\nPull untrusted images? Update: 1.7.36, 2.0.13, 2.2.9, 2.3.6, 2.4.1.", "creation_timestamp": "2026-09-25T01:18:48.188749Z"} 2026-09-25T01:18:48.188749+00:00 https://vulnerability.circl.lu/sighting/692b425c-5745-409a-85da-6f5b7bc9e91b/export 2026-09-26T11:47:21.913744+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "692b425c-5745-409a-85da-6f5b7bc9e91b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mwckh5ge4l2r", "content": "containerd 2.4.1 patches CVE-2026-53493. Matching fixes shipped in 1.7.36, 2.0.13, 2.2.9 and 2.3.6, so the exposure is not limited to the 2.4 line. #software", "creation_timestamp": "2026-09-25T00:50:29.109695Z"} 2026-09-25T00:50:29.109695+00:00