Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-53493, describes a denial-of-service (DoS) issue in containerd's image pull handlers. This occurs when a crafted OCI image index with deeply nested or heavily fanned-out descriptor graphs causes unbounded CPU and memory consumption. The core problem lies in the recursive traversal and processing of child descriptors without sufficient depth and breadth limits, and inadequate deduplication.
Analysis of the provided commit 4f5f32636d47f051751065cf824a10da70c619fe shows modifications to core/images/handlers.go, specifically around the Walk function. This commit introduces a walker struct and a maxReferences constant (10,000) to limit the number of descriptors processed during a walk. The original Walk function lacked this limit, making it vulnerable to unbounded recursion. The patch changes the recursive call to use the new walker.walk method, which enforces the maxReferences limit.
The second commit, 94e83c14c8aac963e24e28105dab9c9af812a2a8, further addresses the issue by refactoring the Dispatch function in the same file. This commit also introduces the maxReferences constant (which was previously defined locally in the first commit's changes to Walk) and implements a mechanism to count and limit the total number of references processed. The Dispatch function was changed from a recursive approach to an iterative breadth-first traversal, incorporating a referenceCount and an admit function to enforce the maxReferences limit. This prevents the function from processing an arbitrarily large number of descriptors, which would lead to resource exhaustion.
Therefore, both images.Walk and images.Dispatch were the primary functions responsible for traversing and processing image descriptors without proper resource limits, making them the vulnerable components. The patches directly introduce these missing limits and refactor the traversal logic to prevent the DoS condition.
images.Walkcore/images/handlers.go
images.Dispatchcore/images/handlers.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/containerd/containerd/v2 | go | >= 2.0.0, < 2.0.13 | 2.0.13 |
| github.com/containerd/containerd | go | <= 1.7.35 | 1.7.36 |
| github.com/containerd/containerd/v2 | go | >= 2.1.0, < 2.2.9 | 2.2.9 |
| github.com/containerd/containerd/v2 | go | >= 2.3.0, < 2.3.6 | 2.3.6 |
| github.com/containerd/containerd/v2 | go | = 2.4.0 | 2.4.1 |