Is CVE-2026-53493 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53493 being exploited in the wild.

How severe is CVE-2026-53493?

Medium severity, with a CVSS score of 4, published 25 September 2026.

Which products and versions are affected?

Containerd before 1.7.36, 2.0.x before 2.0.13, 2.2.x before 2.2.9, 2.3.x before 2.3.6, 2.4.x before 2.4.1; github.com/containerd/containerd (Go) SEMVER:introduced=0,fixed=1.7.36; github.com/containerd/containerd/v2 (Go) SEMVER:introduced=2.0.0,fixed=2.0.13, SEMVER:introduced=2.0.0,fixed=2.0.13,introduced=2.1.0,fixed=2.2.9,introduced=2.3.0,fixed=2.3.6,introduced=2.4.0,fixed=2.4.1.

Is there a fix for CVE-2026-53493?

Yes. github.com/containerd/containerd (Go): upgrade to 1.7.36 or later; github.com/containerd/containerd/v2 (Go): upgrade to 2.0.13, 2.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53493 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-53493?

Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53493: Containerd image-pull denial of service via OCI index graph amplification

CVE-2026-53493 · Severity: medium · CVSS 4 · Published 2026-09-25

Containerd, a widely-used container runtime, is vulnerable to a denial-of-service attack when pulling malicious container images. An attacker can craft a specially designed OCI image with deeply nested or heavily branched descriptor structures that causes the container runtime to consume unbounded CPU and memory during the pull operation, resulting in system stalls and resource exhaustion on the host system.

Technologies: Containerd, github.com/containerd/containerd (Go), github.com/containerd/containerd/v2 (Go). Vendors: Containerd, Go.

Quick answers

Is CVE-2026-53493 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53493 being exploited in the wild.
How severe is CVE-2026-53493?: Medium severity, with a CVSS score of 4, published 25 September 2026.
Which products and versions are affected?: Containerd before 1.7.36, 2.0.x before 2.0.13, 2.2.x before 2.2.9, 2.3.x before 2.3.6, 2.4.x before 2.4.1; github.com/containerd/containerd (Go) SEMVER:introduced=0,fixed=1.7.36; github.com/containerd/containerd/v2 (Go) SEMVER:introduced=2.0.0,fixed=2.0.13, SEMVER:introduced=2.0.0,fixed=2.0.13,introduced=2.1.0,fixed=2.2.9,introduced=2.3.0,fixed=2.3.6,introduced=2.4.0,fixed=2.4.1.
Is there a fix for CVE-2026-53493?: Yes. github.com/containerd/containerd (Go): upgrade to 1.7.36 or later; github.com/containerd/containerd/v2 (Go): upgrade to 2.0.13, 2.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53493 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-53493?: Check whether you run Containerd, github.com/containerd/containerd (Go) or github.com/containerd/containerd/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/containerd/containerd (Go): upgrade to 1.7.36 or later
```
go get github.com/containerd/containerd@v1.7.36
```
github.com/containerd/containerd/v2 (Go): upgrade to 2.0.13, 2.4.1 or later
```
go get github.com/containerd/containerd/v2@v2.4.1
```

Technical details

The vulnerability exists in containerd's OCI image pull handlers during the PullImage operation. The recursive traversal and processing of child descriptors in OCI image indexes lacks sufficient depth and breadth limits and fails to deduplicate identical descriptors, allowing a crafted malicious image with a deeply nested or heavily fanned-out descriptor graph to trigger unbounded CPU and memory consumption. An attacker can exploit this by hosting a malicious image on a container registry or by performing a man-in-the-middle attack against image pulls. The attack requires only that a user attempt to pull the crafted image reference; no authentication or special privileges are required. The impact is a denial of service affecting the container host during the pull phase, prior to container execution. Patches are available in containerd versions 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36.

Affected products

containerd containerd before 1.7.36, 2.0.x before 2.0.13, 2.2.x before 2.2.9, 2.3.x before 2.3.6, 2.4.x before 2.4.1

Identifiers

CVE-2026-53493
GHSA-pg57-6jwg-q645
GO-2026-6597

Timeline

2026-09-25: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-pg57-6jwg-q645
2026-09-25: patched: Patches released in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.