CVE-2026-53495

Medium

Advisory

Published 9 Sept 2026In the index since 10 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.8; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 420; of 17,781 indexed, latest versions
Container images: 418; deployed by those charts
Fix available: 2 of 2; affected packages

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

Carried by container images the latest versions of 420 of 17,781 indexed charts deploy, on 418 images.

Affected package	Affected versions	Fixed in	Images
github.com/containerd/containerdgolang	v1.3.0, v1.3.2, v1.3.3, v1.3.4+63 more	1.7.35	373
github.com/containerd/containerd/v2golang	v2.0.2, v2.0.4, v2.0.5, v2.2.0+12 more	2.0.12, 2.2.8, 2.3.5	56

OSV records: GHSA-7jxh-36q5-gcqv
Trending: Rank 16 in indexed charts, since 10 Sept 2026. See the ranking →

Charts affected

420 by stars

Chart

Latest

Affected images

Radar Score

monitoringthl-charts

0.1.1

2 of 10 See more

monitoring thl-charts 0.1.1

2 of the 10 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
grafana/promtail :2.4.2	626900031c4e	github.com/containerd/containerd@v1.5.4	1.7.35
quay.io/prometheus/prometheus :v2.34.0	b37103e03399	github.com/containerd/containerd@v1.6.1	1.7.35

Open the chart page →

18,908

orchestratremolo

3.1.55

1 of 5 See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
ghcr.io/headlamp-k8s/headlamp :v0.42.0	c9754bae1d79	github.com/containerd/containerd@v1.7.30	1.7.35

Open the chart page →

7,637

trident-protecttrident-protect

100.2606.0

1 of 2 See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
netapp/trident-protect-utils :v2.0.0	cd0c18d8f9ec	github.com/containerd/containerd@v1.7.27	1.7.35

Open the chart page →

1,331

trident-protect-consoletrident-protect

100.2608.0-console

1 of 3 See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
netapp/trident-protect-utils :v2.0.0	cd0c18d8f9ec	github.com/containerd/containerd@v1.7.27	1.7.35

Open the chart page →

1,322

harbor-scanner-trivytrivy-operator

0.31.2

1 of 1 See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	github.com/containerd/containerd@v1.7.16	1.7.35

Open the chart page →

2,477

traceetrivy-operator

0.24.1

1 of 1 See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
aquasec/tracee :0.24.1	cfbbfee972e6	github.com/containerd/containerd@v1.7.29	1.7.35

Open the chart page →

1,074

trouw-servicetrouw-service

1.0.0

1 of 3 See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	github.com/containerd/containerd@v1.3.2	1.7.35

Open the chart page →

7,510

tfy-karpentertruefoundry

0.5.11

1 of 3 See more

tfy-karpenter truefoundry 0.5.11

1 of the 3 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent :v1.5.1-eksbuild.1	988c8e1a273a	github.com/containerd/containerd@v1.7.30	1.7.35

Open the chart page →

645

verhuis-serviceverhuis-service

1.0.0

1 of 3 See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	github.com/containerd/containerd@v1.3.2	1.7.35

Open the chart page →

7,510

verzoekconversieserviceverzoekconversieservice

1.0.0

1 of 3 See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	github.com/containerd/containerd@v1.3.2	1.7.35

Open the chart page →

7,528

verzoekregistratiecomponentverzoekregistratiecomponent

1.1.0

1 of 4 See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	github.com/containerd/containerd@v1.3.2	1.7.35

Open the chart page →

7,429

verzoektypecatalogusverzoektypecatalogus

1.1.0

1 of 4 See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	github.com/containerd/containerd@v1.3.2	1.7.35

Open the chart page →

7,429

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.14.4	5a065930682d	github.com/containerd/containerd@v1.3.3	1.7.35

Open the chart page →

5,484

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	github.com/containerd/containerd@v1.3.3	1.7.35

Open the chart page →

11,119

webresourcecataloguswebresourcecatalogus

1.1.0

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	github.com/containerd/containerd@v1.3.2	1.7.35

Open the chart page →

7,552

harborwenerme

1.19.2

1 of 8 See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
goharbor/trivy-adapter-photon :v2.15.2	215c07b71c37	github.com/containerd/containerd/v2@v2.3.2	2.3.5

Open the chart page →

1,650

mesherywenerme

1.0.69

1 of 1 See more

meshery wenerme 1.0.69

1 of the 1 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
meshery/meshery :stable-latest	9b68e81d392e	github.com/containerd/containerd@v1.7.33	1.7.35

Open the chart page →

1,407

rancherwenerme

2.15.1

2 of 2 See more

rancher wenerme 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
rancher/rancher :v2.15.1	5f6c4dc52a05	github.com/containerd/containerd/v2@v2.3.2-k3s2	2.3.5
rancher/shell :v0.8.1	f293af9c635f	github.com/containerd/containerd@v1.7.32 github.com/containerd/containerd/v2@v2.2.4	1.7.35 2.2.8

Open the chart page →

1,456

traefikwenerme

9.1.1

1 of 1 See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
library/traefik :2.2.8	f5af5a5ce17f	github.com/containerd/containerd@v1.3.2	1.7.35

Open the chart page →

3,369

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-53495.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	github.com/containerd/containerd@v1.6.15	1.7.35

Open the chart page →

13,677

Container images carrying it

418 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/operator-framework/catalogd :v1.8.0	6ff40fa6257f	github.com/containerd/containerd@v1.7.30	1.7.35	1
quay.io/operator-framework/olm	1b6002156f56	github.com/containerd/containerd@v1.7.11	1.7.35	1
quay.io/operator-framework/olm	40d0363f4aa6	github.com/containerd/containerd@v1.7.16	1.7.35	1
quay.io/operator-framework/olm :v0.45.0	f228c7a6b8c5	github.com/containerd/containerd@v1.7.32	1.7.35	1
quay.io/operator-framework/olm	f9ea8cef95ac	github.com/containerd/containerd@v1.6.18	1.7.35	1
quay.io/operator-framework/operator-controller :v1.8.0	bca5dfcc67ca	github.com/containerd/containerd@v1.7.30	1.7.35	1
quay.io/opsmxpublic/opa :1.12.0	84fb1af7401c	github.com/containerd/containerd/v2@v2.2.0	2.2.8	1
quay.io/prometheus/prometheus :v2.33.5	91100b06e86d	github.com/containerd/containerd@v1.6.1	1.7.35	1
quay.io/prometheus/prometheus :v2.34.0	b37103e03399	github.com/containerd/containerd@v1.6.1	1.7.35	1
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	github.com/containerd/containerd@v1.5.1	1.7.35	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	github.com/containerd/containerd@v1.4.3	1.7.35	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	github.com/containerd/containerd@v1.4.13	1.7.35	1
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	github.com/containerd/containerd@v1.4.13	1.7.35	1
quay.io/stackrox-io/stackrox-operator :4.11.3	e12f4ca30515	github.com/containerd/containerd@v1.7.33	1.7.35	1
registry.gitlab.com/bitspur/rock8s/images/kube-commands :3.18	80ef8ceffc92	github.com/containerd/containerd@v1.7.6	1.7.35	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	github.com/containerd/containerd@v1.5.7	1.7.35	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	github.com/containerd/containerd@v1.7.27 github.com/containerd/containerd/v2@v2.3.3	1.7.35 2.3.5	1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller :2.1.2	301847adfe16	github.com/containerd/containerd@v1.7.27	1.7.35	1