https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 26 Sep 2026 11:47:21 +0000 https://vulnerability.circl.lu/sighting/0cb5c622-d9eb-49ed-bc52-46dc60a3fcea/export {"uuid": "0cb5c622-d9eb-49ed-bc52-46dc60a3fcea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://gist.github.com/alon710/a28d447f907845848dd908acc002c8d7", "content": "# CVE-2026-53493: CVE-2026-53493: Uncontrolled Resource Consumption in containerd Image-Pull Descriptor Graph Resolution\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53493\n\n## Summary\ncontainerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. The vulnerability occurs because containerd's image-pull descriptor graph resolution handlers processed OCI image indices and manifests recursively without enforcing boundaries on traversal depth or breadth, and without maintaining a global visited registry to count duplicate references.\n\n## TL;DR\nA crafted OCI index graph can force high CPU and memory usage during image pulls in containerd, leading to Denial of Service (DoS) and node instability.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-53493\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **Privileges Required**: None\n- **CVSS Score**: 6.9\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- containerd\n- **containerd**: < 1.7.36 (Fixed in: `1.7.36`)\n- **containerd**: >= 2.0.0, < 2.0.13 (Fixed in: `2.0.13`)\n- **containerd**: >= 2.2.0, < 2.2.9 (Fixed in: `2.2.9`)\n- **containerd**: >= 2.3.0, < 2.3.6 (Fixed in: `2.3.6`)\n- **containerd**: >= 2.4.0, < 2.4.1 (Fixed in: `2.4.1`)\n\n## Mitigation\n\n- Upgrade containerd to a patched release (1.7.36, 2.0.13, 2.2.9, 2.3.6, or 2.4.1).\n- Configure private registries and restrict pulls to trusted image sources.\n- Implement admission control mechanisms to block untrusted images.\n\n**Remediation Steps:**\n1. Identify affected nodes running vulnerable versions of containerd.\n2. Apply the update package via the operating system package manager or cluster management manifests.\n3. Restart the containerd service to load the patched runtime.\n4. Verify the installation version by running 'containerd --version'.\n\n## References\n\n- [NVD - CVE-2026-53493](https://nvd.nist.gov/vuln/detail/CVE-2026-53493)\n- [GitHub Security Advisory GHSA-pg57-6jwg-q645](https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645)\n- [CVE.org - CVE-2026-53493](https://www.cve.org/CVERecord?id=CVE-2026-53493)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53493) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T06:30:31.000000Z"} {"uuid": "0cb5c622-d9eb-49ed-bc52-46dc60a3fcea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://gist.github.com/alon710/a28d447f907845848dd908acc002c8d7", "content": "# CVE-2026-53493: CVE-2026-53493: Uncontrolled Resource Consumption in containerd Image-Pull Descriptor Graph Resolution\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53493\n\n## Summary\ncontainerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. The vulnerability occurs because containerd's image-pull descriptor graph resolution handlers processed OCI image indices and manifests recursively without enforcing boundaries on traversal depth or breadth, and without maintaining a global visited registry to count duplicate references.\n\n## TL;DR\nA crafted OCI index graph can force high CPU and memory usage during image pulls in containerd, leading to Denial of Service (DoS) and node instability.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-53493\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **Privileges Required**: None\n- **CVSS Score**: 6.9\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- containerd\n- **containerd**: < 1.7.36 (Fixed in: `1.7.36`)\n- **containerd**: >= 2.0.0, < 2.0.13 (Fixed in: `2.0.13`)\n- **containerd**: >= 2.2.0, < 2.2.9 (Fixed in: `2.2.9`)\n- **containerd**: >= 2.3.0, < 2.3.6 (Fixed in: `2.3.6`)\n- **containerd**: >= 2.4.0, < 2.4.1 (Fixed in: `2.4.1`)\n\n## Mitigation\n\n- Upgrade containerd to a patched release (1.7.36, 2.0.13, 2.2.9, 2.3.6, or 2.4.1).\n- Configure private registries and restrict pulls to trusted image sources.\n- Implement admission control mechanisms to block untrusted images.\n\n**Remediation Steps:**\n1. Identify affected nodes running vulnerable versions of containerd.\n2. Apply the update package via the operating system package manager or cluster management manifests.\n3. Restart the containerd service to load the patched runtime.\n4. Verify the installation version by running 'containerd --version'.\n\n## References\n\n- [NVD - CVE-2026-53493](https://nvd.nist.gov/vuln/detail/CVE-2026-53493)\n- [GitHub Security Advisory GHSA-pg57-6jwg-q645](https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645)\n- [CVE.org - CVE-2026-53493](https://www.cve.org/CVERecord?id=CVE-2026-53493)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53493) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-26T06:30:31.000000Z"} https://vulnerability.circl.lu/sighting/0cb5c622-d9eb-49ed-bc52-46dc60a3fcea/export Sat, 26 Sep 2026 06:30:31 +0000 https://vulnerability.circl.lu/sighting/c00c94ad-a29b-42c5-b034-b370b22490c7/export {"uuid": "c00c94ad-a29b-42c5-b034-b370b22490c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwclzrgv7s2f", "content": "containerd patched CVE-2026-53493: a crafted image can pin a node's CPU and memory during the pull, before any container runs.\n\nModerate, not yet exploited.\n\nPull untrusted images? Update: 1.7.36, 2.0.13, 2.2.9, 2.3.6, 2.4.1.", "creation_timestamp": "2026-09-25T01:18:48.188749Z"} {"uuid": "c00c94ad-a29b-42c5-b034-b370b22490c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mwclzrgv7s2f", "content": "containerd patched CVE-2026-53493: a crafted image can pin a node's CPU and memory during the pull, before any container runs.\n\nModerate, not yet exploited.\n\nPull untrusted images? Update: 1.7.36, 2.0.13, 2.2.9, 2.3.6, 2.4.1.", "creation_timestamp": "2026-09-25T01:18:48.188749Z"} https://vulnerability.circl.lu/sighting/c00c94ad-a29b-42c5-b034-b370b22490c7/export Fri, 25 Sep 2026 01:18:48 +0000 https://vulnerability.circl.lu/sighting/692b425c-5745-409a-85da-6f5b7bc9e91b/export {"uuid": "692b425c-5745-409a-85da-6f5b7bc9e91b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mwckh5ge4l2r", "content": "containerd 2.4.1 patches CVE-2026-53493. Matching fixes shipped in 1.7.36, 2.0.13, 2.2.9 and 2.3.6, so the exposure is not limited to the 2.4 line. #software", "creation_timestamp": "2026-09-25T00:50:29.109695Z"} {"uuid": "692b425c-5745-409a-85da-6f5b7bc9e91b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53493", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mwckh5ge4l2r", "content": "containerd 2.4.1 patches CVE-2026-53493. Matching fixes shipped in 1.7.36, 2.0.13, 2.2.9 and 2.3.6, so the exposure is not limited to the 2.4 line. #software", "creation_timestamp": "2026-09-25T00:50:29.109695Z"} https://vulnerability.circl.lu/sighting/692b425c-5745-409a-85da-6f5b7bc9e91b/export Fri, 25 Sep 2026 00:50:29 +0000