Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/containerd/containerd/v2 | go | < 2.0.12 | 2.0.12 |
| github.com/containerd/containerd | go | < 1.7.35 | 1.7.35 |
| github.com/containerd/containerd/v2 | go | >= 2.2.0, < 2.2.8 | 2.2.8 |
| github.com/containerd/containerd/v2 | go | >= 2.3.0, < 2.3.5 | 2.3.5 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-53495, describes a goroutine leak in containerd's CRI plugin when ExecSync is used with long-lived background child processes. The core issue is that the drainExecSyncIO function, responsible for draining input/output pipes, would block indefinitely because it did not monitor the request context for cancellation. This allowed goroutines to accumulate, leading to resource exhaustion and a node-level denial of service.
The provided commit information clearly shows that the fix involves adding case <-ctx.Done(): to the select statement within the drainExecSyncIO function across multiple files (internal/cri/server/container_execsync.go, pkg/cri/server/container_execsync.go, and pkg/cri/sbserver/container_execsync.go). This modification allows the function to terminate gracefully when the context is canceled, preventing the indefinite blocking and subsequent goroutine leak. The patch_evidence directly points to this critical change. Therefore, drainExecSyncIO is identified as the vulnerable function in all its occurrences within the specified file paths, as it was the component that failed to properly manage resource cleanup upon context cancellation.
drainExecSyncIOinternal/cri/server/container_execsync.go
drainExecSyncIOpkg/cri/server/container_execsync.go
drainExecSyncIOpkg/cri/sbserver/container_execsync.go