RATATOSKRATATOSK
Sign in

Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

Project: CRI-OClear ×
CRI-Ov1.36.3Kubernetes CoreAug 4, 2026

This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.

Action needed (1)

  • securityhighCVE-2026-15809 HOME environment-variable injection fix

    cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling /etc/passwd injection through newline characters in the HOME environment variable.

Source
CRI-Ov1.36.0Kubernetes CoreMay 5, 2026

CRI-O v1.36.0 is a substantive operator-facing feature and maintenance release with runtime and operational changes. It also includes a security update to spdystream and a broad dependency refresh.

Action needed (1)

  • securityhighThe spdystream dependency update for CVE-2026-35469

    CRI-O v1.36.0 updates the spdystream dependency to fix CVE-2026-35469.

Source
CRI-Ov1.35.3Kubernetes CoreMay 5, 2026

A maintenance release that adds a runtime metric and a GOMAXPROCS configuration field, fixes two runtime defects, and reverts CNI monitoring after node bootstrapping regressions. It also updates the spdystream dependency to address CVE-2026-35469.

Action needed (2)

  • securityhighThe spdystream dependency update for CVE-2026-35469

    The spdystream dependency is updated to address CVE-2026-35469. The update ships in this release.

  • breakingCRI-O CNI monitoring, reverted

    CRI-O reverts CNI monitoring because it caused node bootstrapping regressions. The change ships in this release.

Source
CRI-Ov1.34.8Kubernetes CoreMay 5, 2026

CRI-O v1.34.8 includes a security-relevant dependency update and adds operator-facing observability and configuration capabilities. The dependency update is the release change that requires upgrading, while the other additions concern optional setup or informational use.

Action needed (1)

  • securityhighCVE-2026-35469 fix in the spdystream dependency

    CRI-O v1.34.8 updates the spdystream dependency to fix CVE-2026-35469.

Source
CRI-Ov1.33.12Kubernetes CoreMay 5, 2026

CRI-O v1.33.12 includes a security fix for a disclosed vulnerability in the spdystream dependency. It also adds the min_injected_gomaxprocs configuration field for controlling the floor of injected GOMAXPROCS values.

Action needed (1)

  • securityhighCVE-2026-35469 fix in the spdystream dependency

    CVE-2026-35469 is fixed by updating the spdystream dependency in CRI-O v1.33.12.

Source
Browse by month