containerd contains a flaw that allows a maliciously crafted image to trigger a denial of service during container creation. The vulnerability arises from unbounded group parsing that leads to unchecked memory allocation. An attacker can thus cause memory exhaustion, resulting in an out‑of‑memory kill of the containerd process. When containerd terminates, the container runtime API becomes unavailable, disrupting dependent services such as Docker Engine or Kubernetes control‑plane components. This weakness is due to improper input validation (CWE‑400) and unchecked allocation (CWE‑770).

Any deployment running containerd versions earlier than the fixed releases—1.7.33, 2.0.10, 2.1.9, 2.2.5, or 2.3.2—is vulnerable. This includes the upstream containerd project as well as distributions that ship containerd, such as Red Hat Containerd. Users who rely on containerd to host containers for Docker, Kubernetes, or other orchestration tools are affected. Updating to the patched releases removes the flaw and restores normal operation.

The reported CVSS score of 5.3 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker delivering a crafted container image—via image pull or embedding the image into a container—so that the unbounded group parsing is exercised during container start. The effect is a local or network‑initiated denial of service; it does not provide privilege escalation, data exfiltration, or code execution.