containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on
    Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in
    internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that
    launch long-lived background child processes retaining standard input and output pipes. The input and
    output drain phase has no default timeout and did not stop when the request context was canceled, so
    repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource
    exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable
    until restart. Deployments not using containerd's CRI implementation and containers not running on Linux
    are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5. (CVE-2026-53495)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a205d8bdfd advisory.

    Update to 1.169.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ad8394dc92 advisory.

    Update to 1.169.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Containerd on the remote host is prior to 1.7.35, 2.0.x prior to 2.0.12, 2.2.x prior to 2.2.8, or 2.3.x prior to 2.3.5. It is, therefore, affected by a denial of service vulnerability. containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21835-1 advisory.

    - CVE-2026-53495: containerd: CRI ExecSync goroutine leak can lead to node-level denial of service     (bsc#1280111).
    - CVE-2026-56854: golang.org/x/crypto/ssh: unenforced source-address restrictions across non-public-key     authentication       callbacks can cause authorization bypasses and unauthorized client logins (bsc#1278624).
    - CVE-2026-56855: golang.org/x/crypto/ssh: unhandled RFC 4254 channel messages can cause connection     deadlocks and       denial of service (bsc#1278624).
    - CVE-2026-78662: golang.org/x/crypto/ssh: unvalidated incoming requests on unestablished channels can     cause connection       deadlocks and denial of service (bsc#1278624).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on     Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in     internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that     launch long-lived background child processes retaining standard input and output pipes. The input and     output drain phase has no default timeout and did not stop when the request context was canceled, so     repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource     exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable     until restart. Deployments not using containerd's CRI implementation and containers not running on Linux     are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5. (CVE-2026-53495)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462443	Echo: multiple github.com/containerd/containerd packages: security update to 1.7.35	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462443	Echo: multiple github.com/containerd/containerd packages: security update to 1.7.35	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
349778	Fedora 45 : doctl (2026-a205d8bdfd)	Nessus	Fedora Local Security Checks	Local	medium
348335	Fedora 44 : doctl (2026-ad8394dc92)	Nessus	Fedora Local Security Checks	Local	medium
347978	Containerd < 1.7.35 / 2.0.x < 2.0.12 / 2.2.x < 2.2.8 / 2.3.x < 2.3.5 DoS	Nessus	Misc.	Local	medium
346193	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21835-1)	Nessus	SuSE Local Security Checks	Local	medium
345883	Linux Distros Unpatched Vulnerability : CVE-2026-53495	Nessus	Misc.	Local	medium
447849	SCA: security update for github.com/containerd/containerd, github.com/containerd/containerd/v2 (GHSA-7jxh-36q5-gcqv)	Tenable Cloud Security	SCA Checks	Local	medium
447849	SCA: security update for github.com/containerd/containerd, github.com/containerd/containerd/v2 (GHSA-7jxh-36q5-gcqv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
447709	Alpine: multiple containerd packages: security update to 2.3.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
447709	Alpine: multiple containerd packages: security update to 2.3.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-53495

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium