containerd
v2.3.7Kubernetes CoreSecurity fixes lead this maintenance release, alongside runtime hardening and correctness changes. Dependency updates alter some default behavior, and the release includes updates to runtime components.
Action needed (7)
securityCVE-2026-95839 and GHSA-vwhp-8p66-mq4f
CVE-2026-95839 and GHSA-vwhp-8p66-mq4f are addressed in this containerd release.
securityGHSA-5p7c-hggf-c748
GHSA-5p7c-hggf-c748 is addressed in this containerd release.
securityGHSA-8647-2jxj-p2rc
GHSA-8647-2jxj-p2rc is addressed in this containerd release.
securityGHSA-hc94-p972-ch66
GHSA-hc94-p972-ch66 is addressed in this containerd release.
breaking
crilog-file following behaviorcrino longer follows the log file in this containerd release.breaking
referencepath traversal rejectionreferencenow rejects.path components that rewrite the host.. breaking
seccompsocket-domain allow-listseccompnow uses an allow-list for socket domains.
All 8 other recorded changesconstraints 3 · value changes 3 · fixes 2
constraints (3)
- remotes/docker: bound parallel fetch readers
- content, remotes: bound reads to expected size
- * core/unpack: don't honor id-mapping labels from image annotations
value changes (3)
- * Update to go1.26.9
- * vendor: google.golang.org/grpc v1.83.2
- * update runc binary to v1.5.2
fixes (2)
- images: skip malformed digests when computing referrer labels
- cri: unmount checkpoint view on every CRImportCheckpoint return path
A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.