Executive brief
containerd is a core component used by Docker and Kubernetes to run and manage containers. A vulnerability allows a specially crafted container image to exhaust the system's memory when it is loaded. This can crash the container runtime, causing a service outage for all other containers on the host and disrupting management tools like Kubernetes.
Technical details
A vulnerability classified as Uncontrolled Resource Consumption (CWE-400) exists in containerd due to unbounded group parsing when processing container images. An attacker with the ability to provide or schedule a maliciously crafted image can trigger memory exhaustion during container creation. This leads to an Out Of Memory (OOM) kill of the containerd process, rendering the runtime API unavailable and impacting downstream clients like Docker Engine or Kubernetes. The issue is fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2. Exploitation requires the ability to import images or schedule pods (PR:L).
Affected products
- containerd containerd >= 1.7.0, < 1.7.33; >= 2.0.0, < 2.0.10; >= 2.1.0, < 2.1.9; >= 2.2.0, < 2.2.5; >= 2.3.0, < 2.3.2
Timeline
- 2026-06-18: advisory: GitHub advisory published by maintainers
- 2026-07-01: disclosed: NVD publication date