A memory exhaustion vulnerability exists in containerd's CRI Attach implementation due to a goroutine leak. Repeated use of the CRI Attach feature, such as via 'kubectl attach', can cause containerd to consume increasing amounts of host memory. This issue has been fixed in containerd versions 1.7.29, 2.0.7, 2.1.5, and 2.2.0. Users are advised to upgrade to these versions. As a workaround, admission controllers can be configured to limit access to pod attach operations.