Allocation of Resources Without Limits or Throttling Affecting github.com/containerd/containerd/v2/internal/cri/server package, versions <2.0.12>=2.2.0 <2.2.8>=2.3.0 <2.3.5

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the drainExecSyncIO function in internal/cri/server/container_execsync.go, pkg/cri/server/container_execsync.go, and pkg/cri/sbserver/container_execsync.go. An attacker can cause containerd to hang and leak goroutines and host memory by running ExecSync requests, such as probes or lifecycle hooks, that leave a background child process holding the exec pipe open after the client disconnects or the context is canceled. When drain_exec_sync_io_timeout is set to 0, the drain path waits indefinitely instead of stopping on cancellation, so repeated requests can exhaust node resources until the containerd daemon is killed by the OOM killer. This leaves CRI exec handling unavailable on the node until containerd is restarted.

Workarounds

• Ensure exec probes and lifecycle hooks do not launch long-lived background child processes; this prevents ExecSync I/O drains from staying blocked while a child keeps the exec pipe open, which can otherwise leak goroutines and host memory until containerd becomes unavailable.

• GitHub Commit v1.7.35
• GitHub Commit v2.0.12
• GitHub Commit v2.2.8
• GitHub Commit v2.3.5
• Maintainer's Advisory