OCI image importer memory exhaustion in github.com/containerd/containerd (CVE-2023-25153)

OCI image importer memory exhaustion in github.com/containerd/containerd (CVE-2023-25153) | HOL Guard CVE

Why this deserves its current priority

CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps github.com/containerd/containerd (go), github.com/containerd/containerd (go). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
github.com/containerd/containerdgo	>=0 <1.5.18	1.5.18
github.com/containerd/containerdgo	>=1.6.0 <1.6.18	1.6.18

Recommended response

Check inventory. Check lockfiles and deployed manifests for github.com/containerd/containerd, github.com/containerd/containerd.
Review the reported fix. Update github.com/containerd/containerd to 1.5.18; github.com/containerd/containerd to 1.6.18 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Feb 16, 2023
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

### Impact When importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. ### Patches This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. ### Workarounds Ensure that only trusted images are used and that only trusted users have permissions to import images. ### Credits The containerd project would like to thank [David Korczynski](https://github.com/DavidKorczynski) and [Adam Korczynski](https://github.com/AdamKorcz) of ADA Logics for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md) during a security fuzzing audit sponsored by CNCF. ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at [[email protected]](mailto:[email protected]) To report a security issue in containerd: * [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new) * Email us at [[email protected]](mailto:[email protected])

Quoted source text, attributed separately from HOL analysis.