Containerd is an open‑source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5, and 2.3.2 contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service condition. During container creation, the flaw triggers memory exhaustion, forcing an Out Of Memory kill of the containerd process. This renders the container runtime API unavailable and disrupts Docker Engine or Kubernetes control‑plane components. The vulnerability stems from unchecked allocation (CWE‑770) and improper input validation (CWE‑400).

Any deployment running containerd before the fixed releases – 1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2 – is vulnerable. This includes the upstream containerd project, Red Hat Hummingbird 1, and any orchestration platform that relies on these runtimes.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is less than 1%. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker delivering a crafted image; during image pull or container start the flaw leads to an OOM kill of the containerd process. The effect is purely a denial of service and does not grant privilege escalation or data exfiltration.