Medium
containerd OCI image importer memory exhaustion
Type: advisorySources: OSV
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-25153
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 04:53 UTC · Revision 1
Source evidence
containerd OCI image importer memory exhaustion
core-osv · Original sourcePublished 16 Feb 2023, 14:09 UTC
containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
osv:CVE-2023-25153
Complete source record
{
"id": "d3d69a77be52ced0350b662e83cb8f5fd19754807a37ae86d6989af5d40fd115",
"url": "https://osv.dev/vulnerability/CVE-2023-25153",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "containerd OCI image importer memory exhaustion",
"summary": "containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.",
"evidence": "osv:CVE-2023-25153",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-25153",
"aliases": [
"CVE-2023-25153",
"GHSA-259w-8hf6-59c2",
"GO-2023-1573"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/containerd/containerd",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "39bb06f98f17c7a226b10269d325c861585b2389"
},
{
"introduced": "39259a8f35919a0d02c9ecc2871ddd6ccf6a7c6e"
},
{
"fixed": "2456e983eb9e37e47538f59ea18f2043c9a73640"
},
{
"fixed": "0c314901076a74a7b797a545d2f462285fdbb8c4"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.5.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.6.18"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "0c314901076a74a7b797a545d2f462285fdbb8c4"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "39bb06f98f17c7a226b10269d325c861585b2389"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.5.18"
},
{
"range": [
{
"fixed": "2456e983eb9e37e47538f59ea18f2043c9a73640"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.6.18"
}
]
}
}
],
"versions": [
"v1.5.17",
"v1.6.17",
"v1.6.13",
"v1.6.16",
"v1.6.15",
"v1.6.14",
"v1.5.16",
"v1.6.12",
"v1.5.15",
"v1.6.11",
"v1.6.10",
"v1.6.9",
"v1.5.14",
"v1.5.8",
"v1.6.8",
"v1.6.7",
"v1.5.13",
"v1.6.6",
"v1.5.12",
"v1.6.5",
"v1.6.4",
"v1.6.3",
"v1.6.2",
"v1.5.11",
"v1.6.1",
"v1.5.10",
"v1.6.0",
"v1.5.9",
"v1.5.7",
"v1.5.6",
"v1.5.5",
"v1.5.4",
"v1.5.3",
"v1.5.2",
"v1.5.1",
"v1.5.0",
"v1.5.0-rc.3",
"v1.5.0-rc.2",
"v1.5.0-rc.1",
"v1.5.0-rc.0",
"v1.5.0-beta.4",
"v1.5.0-beta.3",
"v1.5.0-beta.2",
"v1.5.0-beta.1",
"v1.5.0-beta.0",
"v1.4.0",
"v1.4.0-rc.1",
"v1.4.0-rc.0",
"v1.4.0-beta.2",
"v1.4.0-beta.1",
"v1.4.0-beta.0",
"v1.3.0",
"v1.3.0-rc.3",
"v1.3.0-rc.2",
"v1.3.0-rc.1",
"v1.3.0-rc.0",
"v1.3.0-beta.2",
"v1.3.0-beta.1",
"v1.3.0-beta.0",
"v1.2.0",
"v1.2.0-rc.2",
"v1.2.0-rc.1",
"v1.2.0-rc.0",
"v1.2.0-beta.2",
"v1.2.0-beta.1",
"v1.2.0-beta.0",
"v1.1.0",
"v1.1.0-rc.2",
"v1.1.0-rc.1",
"v1.1.0-rc.0",
"v1.0.0",
"v1.0.0-rc.0",
"v1.0.0-beta.3",
"v1.0.0-beta.2",
"v1.0.0-beta.1",
"v1.0.0-beta.0",
"v1.0.0-alpha6",
"v1.0.0-alpha5",
"v1.0.0-alpha4",
"v1.0.0-alpha3",
"v1.0.0-alpha2",
"v1.0.0-alpha1",
"v1.0.0-alpha0",
"v0.2.0",
"0.0.5",
"0.0.4",
"0.0.3",
"0.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25153.json"
}
}
],
"modified": "2026-10-28T02:30:49.971794555Z",
"provider": "osv",
"references": [
"https://github.com/containerd/containerd/releases/tag/v1.5.18",
"https://github.com/containerd/containerd/releases/tag/v1.6.18",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25153.json",
"https://github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2",
"https://nvd.nist.gov/vuln/detail/CVE-2023-25153",
"https://github.com/containerd/containerd/commit/0c314901076a74a7b797a545d2f462285fdbb8c4"
],
"provider_metadata": {
"cwe_ids": [
"CWE-770"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25153.json"
}
},
"related_cves": [
{
"value": "CVE-2023-25153",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518288,
"published_at": "2023-02-16T14:09:08.519+00:00"
}