containerd

v2.0.14Kubernetes Core

Oct 13, 2026

A security-focused maintenance release hardens runtime behavior, image unpacking, and content reads. It bounds content reads to the expected size and adds no operator-facing configuration handles.

Action needed (4)

securityGHSA-hc94-p972-ch66 advisory
The release includes advisory GHSA-hc94-p972-ch66.
**GHSA-hc94-p972-ch66**
breakingcri log file following behavior
cri no longer follows log files.
containerd#14299 85b6459b2
breakingid-mapping label handling in core/unpack
core/unpack no longer honors id-mapping labels from image annotations.
containerd#14270 1e0b4964e 6e9229820
breakingseccomp socket domain allow-list
seccomp uses an allow-list for socket domains.
containerd#14251 1183551f1

All 1 other recorded changesvalue changes 1

value changes (1)

* [21fd0a996](https://github.com/containerd/containerd/commit/21fd0a996b9cf97752d28c0d98290759f7ad9732) content, remotes: bound reads to expected size

Add containerd to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All containerd releases →