Multiple security vulnerabilities have been identified in containerd, an open-source container runtime. The issues affect image pull and unpack processing, as well as the CRI checkpoint restore path in certain v2 releases and the 1.7 line. They can allow denial of service through crafted image data and privilege escalation when restoring untrusted checkpoints. Overall risk is elevated for hosts that pull or import images from untrusted sources or use checkpoint restore.
CVE-2026-53493 (CVSS 3.0 — Low): The image pull handler can be made to traverse a crafted OCI image index with deeply nested or heavily fanned-out descriptor graphs. An attacker who can supply a malicious image reference can cause excessive CPU and memory consumption before container execution.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in containerd, an open-source container runtime. The issues affect image pull and unpack processing, as well as the CRI checkpoint restore path in certain v2 releases and the 1.7 line. They can allow denial of service through crafted image data and privilege escalation when restoring untrusted checkpoints. Overall risk is elevated for hosts that pull or import images from untrusted sources or use checkpoint restore.
CVE-2026-53493 (CVSS 3.0 — Low): The image pull handler can be made to traverse a crafted OCI image index with deeply nested or heavily fanned-out descriptor graphs. An attacker who can supply a malicious image reference can cause excessive CPU and memory consumption before container execution.[emaillocker id="1283"]
CVE-2026-95837 (CVSS 7.8 — High): The CRI checkpoint restore path can restore process credentials, capabilities, and security restrictions from checkpoint data instead of enforcing the destination security context. An attacker who can run a container from a crafted checkpoint image may execute with elevated privileges despite restrictive orchestrator policies.
CVE-2026-95838 (CVSS 3.0 — Low): The layer unpack handler can process crafted image layers with repeated opaque whiteouts in a way that causes superlinear traversal time. An attacker who can pull or import a malicious image can increase CPU usage and delay container startup.
These vulnerabilities collectively present a significant risk to container hosts that process untrusted image content or use checkpoint restore. The most exposed deployments are those that pull images from untrusted sources or permit container creation with checkpoint data. Organizations should assess their exposure to untrusted image and checkpoint usage.
We recommend you to update containerd to version 2.4.1, 2.3.6, 2.2.9, 2.0.13, or 1.7.36 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]