containerd

v2.4.2Kubernetes Core

Oct 13, 2026

A security-focused maintenance release with advisory fixes, updated Go and runc components, and hardening changes that can alter accepted behavior. It also fixes image-transfer correctness and resource-usage issues.

Action needed (7)

securityCVE-2026-95839 security advisory
The release includes the security advisory CVE-2026-95839, also identified as GHSA-vwhp-8p66-mq4f.
**CVE-2026-95839**
securityGHSA-8647-2jxj-p2rc security advisory
The release includes the security advisory GHSA-8647-2jxj-p2rc.
**GHSA-8647-2jxj-p2rc**
securityGHSA-hc94-p972-ch66 security advisory
The release includes the security advisory GHSA-hc94-p972-ch66.
**GHSA-hc94-p972-ch66**
securityGo go1.26.9 and go1.27.2 updates
containerd ships with updates to Go go1.26.9 and go1.27.2.
containerd#14350 9c06c813e
breakingcri log-file following behavior
The cri component no longer follows log files.
containerd#14302 098de667d
breakingreference path-component validation
The reference component rejects .. path components that rewrite the host.
containerd#14282 6b631559b
breakingseccomp socket-domain allow-list
seccomp uses an allow-list for socket domains.
containerd#14247 7936ee578

All 5 other recorded changesvalue changes 4 · constraints 1

value changes (4)

* [44fd201a8](https://github.com/containerd/containerd/commit/44fd201a89b74fb0f7f41b95ec4622ebd38571f0) remotes/docker: bound parallel fetch readers
* [a2eb01f66](https://github.com/containerd/containerd/commit/a2eb01f667b320b00ec218216f26f7b79197d4cd) images: skip malformed digests when computing referrer labels
* remotes/docker: throttle worker chunk buffers ([#14342](https://github.com/containerd/containerd/pull/14342)) * [6a78f854a](https://github.com/containerd/containerd/commit/6a78f854af4ba1366fb95f0d66324e3e10e250d1) remotes/docker: limit chunk buffers per layer
* update runc binary to v1.5.2 ([#14241](https://github.com/containerd/containerd/pull/14241)) * [54a82dcf0](https://github.com/containerd/containerd/commit/54a82dcf0b7a7776ea03f96a80ee10d0213e23b5) update runc binary to v1.5.2

constraints (1)

* [7f0c0b822](https://github.com/containerd/containerd/commit/7f0c0b822e20abc52d21b71aa211f991a816b913) content, remotes: bound reads to expected size

Add containerd to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All containerd releases →