containerd CRI stream server vulnerable to host memory exhaustion via terminal (CVE-2022-23471)

containerd CRI stream server vulnerable to host memory exhaustion via terminal (CVE-2022-23471) | HOL Guard CVE

Why this deserves its current priority

CVSS is 5.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps github.com/containerd/containerd (go), github.com/containerd/containerd (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
github.com/containerd/containerdgo	>=0 <1.5.16	1.5.16
github.com/containerd/containerdgo	>=1.6.0 <1.6.12	1.6.12

Recommended response

Check inventory. Check lockfiles and deployed manifests for github.com/containerd/containerd, github.com/containerd/containerd.
Review the reported fix. Update github.com/containerd/containerd to 1.5.16; github.com/containerd/containerd to 1.6.12 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Dec 7, 2022
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Impact A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. ### Patches This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. ### Workarounds Ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at [[email protected]](mailto:[email protected]) To report a security issue in containerd: * [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new) * Email us at [[email protected]](mailto:[email protected])

Quoted source text, attributed separately from HOL analysis.