CVE-2023-25153 - CVE House
Back to Database
Status published Medium CVE-2023-25153

containerd OCI image importer memory exhaustion

Vulnerability Description

containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25153

Credits & Attribution

No credits recorded in the NVD database.

References

More from containerd

View All →
CVE-2025-64329
containerd CRI server: Host memory exhaustion through Attach goroutine leak
Medium 6.9
CVE-2025-47291
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
Medium 4.6
CVE-2025-47290
Containerd vulnerable to host filesystem access during image unpack
High 7.6
CVE-2024-40635
containerd has an integer overflow in User ID handling
Medium 4.6
CVE-2024-25621
containerd affected by a local privilege escalation via wide permissions on CRI directory
High 7.3

Affected Vendor

Affected Software

containerd
Vulnerable Versions:
< 1.5.18, >= 1.6.0, < 1.6.18

Timeline

Official Publish: February 16th, 2023
Last Modified: March 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery