{"items":[{"id":"NVI-00014141","kind":"vulnerability","title":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7jxh-36q5-gcqv","CVE-2026-53495"],"plain_summary":"GitHub lists this reviewed advisory for github.com/containerd/containerd/v2, github.com/containerd/containerd, github.com/containerd/containerd/v2, github.com/containerd/containerd/v2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4fb82bcc210b4a13b1fe3a6c44bec804"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4fb82bcc210b4a13b1fe3a6c44bec804","url":"https://github.com/advisories/GHSA-7jxh-36q5-gcqv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7jxh-36q5-gcqv","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:12.705Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4fb82bcc210b4a13b1fe3a6c44bec804"],"technology":"github.com/containerd/containerd/v2","known_exclusions":[],"conditions_summary":"### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Li","public_affected_ranges":["< 2.0.12"]},{"certainty":"source_listed","source_ids":["sr-4fb82bcc210b4a13b1fe3a6c44bec804"],"technology":"github.com/containerd/containerd","known_exclusions":[],"conditions_summary":"### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Li","public_affected_ranges":["< 1.7.35"]},{"certainty":"source_listed","source_ids":["sr-4fb82bcc210b4a13b1fe3a6c44bec804"],"technology":"github.com/containerd/containerd/v2","known_exclusions":[],"conditions_summary":"### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Li","public_affected_ranges":[">= 2.2.0, < 2.2.8"]},{"certainty":"source_listed","source_ids":["sr-4fb82bcc210b4a13b1fe3a6c44bec804"],"technology":"github.com/containerd/containerd/v2","known_exclusions":[],"conditions_summary":"### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Li","public_affected_ranges":[">= 2.3.0, < 2.3.5"]}],"null_published_at":"2026-11-02T10:00:37.212Z","source_updated_at":"2026-09-09T18:01:35.000Z","source_disclosed_at":"2026-09-09T18:01:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:12.705Z"}],"next_cursor":null,"snapshot_revision":"44495"}