containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
Priority LOW 29CWE-400Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 46 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Partial containerd (containerd): 1.7.35, 2.0.12, 2.2.8 +1github.com/containerd/containerd/v2 (Go): 2.0.12, 2.2.8, 2.3.5+1 more productRed Hat: 46 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | containerd | before 1.7.35; 2.0.0 to before 2.0.12; 2.2.0 to before 2.2.8; 2.3.0 to before 2.3.5 | 1.7.35, 2.0.12, 2.2.8, 2.3.5 | Patch available | CNA |
| — | github.com/containerd/containerd/v2 (Go) | before 2.0.12 | 2.0.12 | Patch available | GHSA-7jxh-36q5-gcqv |
| — | github.com/containerd/containerd (Go) | before 1.7.35 | 1.7.35 | Patch available | GHSA-7jxh-36q5-gcqv |
| — | github.com/containerd/containerd/v2 (Go) | 2.2.0 to before 2.2.8 | 2.2.8 | Patch available | GHSA-7jxh-36q5-gcqv |
| — | github.com/containerd/containerd/v2 (Go) | 2.3.0 to before 2.3.5 | 2.3.5 | Patch available | GHSA-7jxh-36q5-gcqv |
- containerd Vendorbackstage Affected before 1.7.35; 2.0.0 to before 2.0.12; 2.2.0 to before 2.2.8; 2.3.0 to before 2.3.5 Fixed in 1.7.35, 2.0.12, 2.2.8, 2.3.5 Patch available CNA
- github.com/containerd/containerd/v2 (Go) Vendor— Affected before 2.0.12 Fixed in 2.0.12 Patch available GHSA-7jxh-36q5-gcqv
- github.com/containerd/containerd (Go) Vendor— Affected before 1.7.35 Fixed in 1.7.35 Patch available GHSA-7jxh-36q5-gcqv
- github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.2.0 to before 2.2.8 Fixed in 2.2.8 Patch available GHSA-7jxh-36q5-gcqv
- github.com/containerd/containerd/v2 (Go) Vendor— Affected 2.3.0 to before 2.3.5 Fixed in 2.3.5 Patch available GHSA-7jxh-36q5-gcqv
Remediation
- Fix · CNA containerd (containerd) Fixed in 1.7.35, 2.0.12, 2.2.8, 2.3.5
- Fix · GHSA-7jxh-36q5-gcqv github.com/containerd/containerd/v2 (Go) Fixed in 2.0.12 Advisory →
- Fix · GHSA-7jxh-36q5-gcqv github.com/containerd/containerd (Go) Fixed in 1.7.35 Advisory →
- Fix · GHSA-7jxh-36q5-gcqv github.com/containerd/containerd/v2 (Go) Fixed in 2.2.8 Advisory →
- Fix · GHSA-7jxh-36q5-gcqv github.com/containerd/containerd/v2 (Go) Fixed in 2.3.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| AWS Load Balancer Operator | Affected | No fix planned: Out of support scope |
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix planned: Out of support scope |
| Compliance Operator | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Deployment Validation Operator | Affected | No fix yet: Fix deferred |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| Logical Volume Manager Storage | Affected | No fix yet: Fix deferred |
| MCP Server for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Machine Deletion Remediation Operator | Affected | No fix planned: Out of support scope |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix planned: Out of support scope |
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift for Windows Containers | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 17.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Service Interconnect 2 | Affected | No fix planned: Out of support scope |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Web Terminal | Affected | No fix yet: Fix deferred |
Not affected: 3 products
- Red Hat Hardened Images
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53495
- 2026-10-03 Alias added: GHSA-7jxh-36q5-gcqv
- 2026-10-27 Affected versions changed · Red Hat
- 2026-11-01 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Other 11
- https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv
- https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880c
- https://github.com/containerd/containerd/commit/5a2a3a759b0d2ad8c821b33c3afc20890daf6d81
- https://github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaa
- https://github.com/containerd/containerd/commit/eebea8c4c912f44b656c8295c9e6607a19b76650
- https://github.com/containerd/containerd/commit/ff39a972369e2f12fae561a58d658bbf8f2bc318
- https://github.com/containerd/containerd/releases/tag/v2.0.12
- https://github.com/containerd/containerd/releases/tag/v2.2.8
- https://github.com/containerd/containerd/releases/tag/v2.3.5
- https://github.com/containerd/containerd
- https://github.com/containerd/containerd/releases/tag/v1.7.35
More backstage vulnerabilities
- TI-2026-33119 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys KEVCVSS 3.1CRITICAL 9.6
- TI-2018-10499 Integer overflow in backstage kernel KEVCVSS 3.0HIGH 7.8
- TI-2024-08998 Remote Code Execution in kedro-org/kedro CVSS 3.0CRITICAL 9.8
- TI-2023-12294 Dragonfly2 vulnerable to hard coded cyptographic key CVSS 3.1CRITICAL 9.8
- TI-2021-12074 Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via… CVSS 3.1CRITICAL 9.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
Sources
- CVE-2026-53495 · CVE Program
- CVE-2026-53495 · NVD
- FIRST EPSS
- GHSA-7jxh-36q5-gcqv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-53495 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences