Resource exhaustion in containerd - #VU159333
Published: November 4, 2026
Vulnerability identifier: #VU159333
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by exhausting host disk space.
The vulnerability exists due to uncontrolled resource consumption in containerd's image pull process when downloading image layers without limiting incoming bytes to their declared size before validation. A remote attacker can induce a victim to pull a crafted image that supplies an unbounded layer stream to exhaust host disk space, potentially rendering containerd and the Kubernetes kubelet unresponsive and blocking new pod startup.
Affected software
containerd
Remediation
Install security update from vendor's website.
containerd - addressed in versions 2.0.14, 2.2.10, 2.3.7, 2.4.2