containerd
v2.2.8Kubernetes CoreSep 4, 2026
A security and maintenance release with fixes for two security advisories, request hardening, runtime and snapshot correctness, and a small performance improvement. No operator migration requirement is stated.
Action needed (2)
securityThe CVE-2026-53495 security advisory
CVE-2026-53495 and GHSA-7jxh-36q5-gcqv are addressed in this containerd release.
securityThe GHSA-rp3h-jf77-q9p4 security advisory
GHSA-rp3h-jf77-q9p4 is addressed in this containerd release.
All 6 other recorded changesvalue changes 4 · fixes 2
value changes (4)
- * [
22ccf4314](https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880c) cri: cancel ExecSync IO drain on context cancellation - * [
45166eb82](https://github.com/containerd/containerd/commit/45166eb828c9f8605db44299836a87b78bda701b) archive: skip redundant opaque whiteout walks - * Set SystemTemp env var to config temp on Windows ([#14102](https://github.com/containerd/containerd/pull/14102)) * [
2c722ad04](https://github.com/containerd/containerd/commit/2c722ad0418df21ff173c3f54dd3dd4713302cd8) Set SystemTemp env var to config temp on Windows - docker fetcher: strip sensitive headers on descriptor URLs
fixes (2)
- * pkg/oci: resolve rootfs symlinks for user lookup ([#14005](https://github.com/containerd/containerd/pull/14005)) * [
196664bc0](https://github.com/containerd/containerd/commit/196664bc020998bf20f3d96708edcaacc5c891d0) pkg/oci: resolve rootfs symlinks for user lookup - * snapshots/erofs: protect snapshot staging from cleanup ([#13950](https://github.com/containerd/containerd/pull/13950)) * [
f7075a224](https://github.com/containerd/containerd/commit/f7075a224aa2f17d5e4afcc3026a6ac644b5c93b) snapshots/erofs: protect snapshot staging from cleanup
Add containerd to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.