Hi,

The following vulnerability was published for containerd.

CVE-2026-53495[0]:
| containerd is an open-source container runtime. Prior to 1.7.35,
| 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin
| enabled can indefinitely block the drainExecSyncIO goroutine in
| internal/cri/server/container_execsync.go when CRI ExecSync is used
| by exec probes or lifecycle hooks that launch long-lived background
| child processes retaining standard input and output pipes. The input
| and output drain phase has no default timeout and did not stop when
| the request context was canceled, so repeated ExecSync invocations
| can accumulate blocked goroutines and host memory. The resulting
| resource exhaustion can cause the OOM killer to terminate
| containerd, leaving the container runtime unavailable until restart.
| Deployments not using containerd's CRI implementation and containers
| not running on Linux are not affected. This issue is fixed in
| versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-53495
https://www.cve.org/CVERecord?id=CVE-2026-53495
[1] https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore