{"id":"EUVD-2026-86486","enisaUuid":"d699ea72-02e7-3a97-b1c7-9a8efc72a4ba","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","datePublished":"Sep 25, 2026, 12:06:43 AM","dateUpdated":"Sep 28, 2026, 2:58:33 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645\n","aliases":"CVE-2026-53493\nGHSA-pg57-6jwg-q645\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"06895d80-c90d-3637-9ec2-789fc6218a5e","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003d 2.4.0"},{"id":"95aef533-e142-3311-a9f2-aed5ab69bafe","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.3.0, \u003c 2.3.6"},{"id":"9d6aca2f-818a-327d-aa1c-7c3ec1ab00f6","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.0.0, \u003c 2.0.13"},{"id":"d996381d-70d2-3e20-912c-c91f6f56f89f","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003c 1.7.36"},{"id":"decfa936-fb0a-31a2-962e-79eba09026ef","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.1.0, \u003c 2.2.9"}],"enisaIdVendor":[{"id":"4ba07b91-16f6-3190-93e3-42b086405d15","vendor":{"name":"containerd"}}],"enisaIdVulnerability":[{"id":"f796099c-6eda-3133-be81-f42c4377dc21","vulnerability":{"id":"CVE-2026-53493","description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","datePublished":"Sep 25, 2026, 12:06:43 AM","dateUpdated":"Sep 28, 2026, 2:58:33 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645\n","enisa_id":"EUVD-2026-86486\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Oct 28, 2026, 7:16:16 AM","vulnerabilityProduct":[{"id":"413e9de8-afa6-3958-a370-59375fda13e7","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.1.0, \u003c 2.2.9"},{"id":"70c3fca2-990e-3db4-b01a-d7d35d374dd1","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.3.0, \u003c 2.3.6"},{"id":"c3b1e62d-2a88-37b1-9d48-e7f71d47541f","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003d 2.4.0"},{"id":"d5c0fb67-45df-321a-bddd-7b6aa9a4280d","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"\u003c 1.7.36"},{"id":"d646c25c-2636-3f29-80bd-7164686fa24c","product":{"name":"containerd","vendor":{"name":"containerd"}},"product_version":"2.0.0, \u003c 2.0.13"}],"vulnerabilityVendor":[{"id":"accb8afb-3712-33fc-aff9-8f01544764eb","vendor":{"name":"containerd"}}]}},{"id":"f7a9dbe1-d75d-3595-aa27-53a463b83c2b","vulnerability":{"id":"GHSA-pg57-6jwg-q645","description":"Containerd has image-pull DoS via crafted OCI index graph amplification","datePublished":"Sep 25, 2026, 7:27:59 PM","dateUpdated":"Sep 25, 2026, 7:27:59 PM","baseScore":0.0,"references":"https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53493\nhttps://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe\nhttps://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8\nhttps://github.com/containerd/containerd\nhttps://github.com/containerd/containerd/releases/tag/v1.7.36\nhttps://github.com/containerd/containerd/releases/tag/v2.0.13\nhttps://github.com/containerd/containerd/releases/tag/v2.2.9\nhttps://github.com/containerd/containerd/releases/tag/v2.3.6\nhttps://github.com/containerd/containerd/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-86486\n","aliases":"GHSA-pg57-6jwg-q645\nCVE-2026-53493\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"0d84e20e-49e2-35f4-a264-459094d190a4","advisory":{"id":"msrc_CVE-2026-53493","description":"Containerd has image-pull DoS via crafted OCI index graph amplification","datePublished":"Sep 28, 2026, 3:31:27 AM","dateUpdated":"Oct 14, 2026, 2:18:25 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53493.json\n","aliases":"CVE-2026-53493\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"5a4b95b3-6183-37fd-b401-217cb3c7bdf0","product":{"name":"azl3 moby-containerd-cc 0:1.7.7-17.azl3","vendor":{"name":"Microsoft"}}},{"id":"65f4dcb3-14db-39e9-b4be-363c32858898","product":{"name":"moby-containerd-cc","vendor":{"name":"Microsoft"}}},{"id":"a9507745-2d31-3801-83b7-42916320db75","product":{"name":"containerd2","vendor":{"name":"Microsoft"}}},{"id":"de82911d-9516-3329-8047-9c68f335714e","product":{"name":"azl3 containerd2 0:2.3.4-1.azl3","vendor":{"name":"Microsoft"}}},{"id":"ee72aeee-0cad-35de-866c-bae3aa8d228b","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"f4bed9ec-768a-34fb-9a78-f122e98642d8","product":{"name":"3.0","vendor":{"name":"Wind River"}}}]}},{"id":"c5577e59-a1f4-3b85-a6b8-2e534249214b","advisory":{"id":"openSUSE-SU-2026:12127-1","description":"elemental3-3.0.4-1.1 on GA media","summary":"elemental3-3.0.4-1.1 on GA media","datePublished":"Oct 14, 2026, 12:00:00 AM","dateUpdated":"Oct 15, 2026, 9:49:49 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12127-1.json\nhttps://www.suse.com/security/cve/CVE-2026-53493/\n","aliases":"CVE-2026-53493\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"30ac2132-2c7b-346a-8be0-b0930257eede","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"468c705d-4063-3de0-9495-e84e03b53846","product":{"name":"elemental3-0:3.0.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"59c99aba-f791-3d8e-8716-65970f04eceb","product":{"name":"elemental3-0:3.0.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"62566ee1-a63e-38c2-b2e1-27003a5c9933","product":{"name":"elemental3ctl-0:3.0.4-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a526cae2-1f48-3bde-b573-53df72c2c230","product":{"name":"elemental3ctl-0:3.0.4-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a6bf65c2-43f3-3efe-88b1-9a0c0658623a","product":{"name":"elemental3ctl-0:3.0.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b9b3e86e-66e2-35c8-9386-6c0fbc447c30","product":{"name":"elemental3-0:3.0.4-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"d550a39c-93e7-303c-bd79-f03f41e414f2","product":{"name":"elemental3-0:3.0.4-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d7ee8906-3b50-39a7-a91f-209fb076f730","product":{"name":"elemental3ctl-0:3.0.4-1.1.s390x","vendor":{"name":"SUSE"}}}]}}]}