Allocation of Resources Without Limits or Throttling in containerd - #VU155695
Published: October 14, 2026
Vulnerability identifier: #VU155695
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits in containerd's image pull process when downloading image layers from an untrusted registry. A remote attacker can return a crafted Content-Length header to cause a denial of service.
Exploitation requires parallel layer fetch to be enabled through the concurrent_layer_fetch_buffer setting. The crafted header triggers an unhandled memory allocation panic that crashes the daemon. Existing running containers remain unaffected.
Affected software
containerd
Remediation
Install security update from vendor's website.
containerd - addressed in versions 2.2.10, 2.3.7, 2.4.2