containerd
v2.2.10Kubernetes CoreA security-focused maintenance release with advisory fixes, runtime hardening, correctness fixes, and a Go toolchain update that changes several default protections. It also includes multipart fetch stability work, CRI log handling corrections, and unpack behavior changes.
Action needed (5)
securityCVE-2026-95839 correction
containerdv2.2.10 includes a correction for CVE-2026-95839, also tracked as GHSA-vwhp-8p66-mq4f.securityGHSA-8647-2jxj-p2rc correction
containerdv2.2.10 includes a correction for GHSA-8647-2jxj-p2rc.securityGHSA-hc94-p972-ch66 correction
containerdv2.2.10 includes a correction for GHSA-hc94-p972-ch66.breakingHost-rewriting
.path components rejected. The
referencehandling incontainerdv2.2.10 rejects.path components that rewrite the host.. breaking
seccompsocket-domain allow-listThe
seccompconfiguration incontainerdv2.2.10 uses an allow-list for socket domains.
All 4 other recorded changesvalue changes 3 · fixes 1
value changes (3)
- * Update to go1.26.9
- * cri: should not follow log file ([#14300](https://github.com/containerd/containerd/pull/14300))
- * core/unpack: don't honor id-mapping labels from image annotations ([#14269](https://github.com/containerd/containerd/pull/14269))
fixes (1)
- * multipart fetch stability fixes ([#14316](https://github.com/containerd/containerd/pull/14316))
A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.