Executive brief
Containerd, a widely-used container runtime, is vulnerable to a denial-of-service attack when pulling malicious container images. An attacker can craft a specially designed OCI image with deeply nested or heavily branched descriptor structures that causes the container runtime to consume unbounded CPU and memory during the pull operation, resulting in system stalls and resource exhaustion on the host system.
Technical details
The vulnerability exists in containerd's OCI image pull handlers during the PullImage operation. The recursive traversal and processing of child descriptors in OCI image indexes lacks sufficient depth and breadth limits and fails to deduplicate identical descriptors, allowing a crafted malicious image with a deeply nested or heavily fanned-out descriptor graph to trigger unbounded CPU and memory consumption. An attacker can exploit this by hosting a malicious image on a container registry or by performing a man-in-the-middle attack against image pulls. The attack requires only that a user attempt to pull the crafted image reference; no authentication or special privileges are required. The impact is a denial of service affecting the container host during the pull phase, prior to container execution. Patches are available in containerd versions 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36.
Affected products
- containerd containerd before 1.7.36, 2.0.x before 2.0.13, 2.2.x before 2.2.9, 2.3.x before 2.3.6, 2.4.x before 2.4.1
Timeline
- 2026-09-25: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-pg57-6jwg-q645
- 2026-09-25: patched: Patches released in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36