This release fixes user-namespace UID/GID restoration after CRI-O restart, reduces debug-log verbosity for List* RPC calls, and restores pre-1.34 handling of environment-variable values containing non-UTF-8 data. It also updates or removes dependencies listed in the dependency manifest.
Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Project: CRI-OClear ×
CRI-O v1.34.11 includes a correctness fix that restores prior handling of environment-variable values containing non-UTF-8 data. No detailed change item is provided here.
Source ↗This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.
Action needed (1)
securityhighCVE-2026-15809 HOME environment-variable injection fix
cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling
/etc/passwdinjection through newline characters in theHOMEenvironment variable.
CRI-O v1.35.5 includes an operator-facing correctness fix for container status ImageRef values after a CRI-O restart. It also updates CPU injection and gomaxprocs handling to account for workload partitioning and reduce potential Go scheduler throttling.
This release has no detailed changes available for display. The remaining release-note entry describes an operator-facing performance behavior update involving the gomaxprocs hook and CPU allocation.
CRI-O v1.34.10 is an operator-facing maintenance release with bug fixes in CPU allocation and container status reporting. It adjusts CPU handling to reduce scheduler throttling and preserves the ImageRef value across CRI-O restarts. No security advisories are identified.
This release contains no operator-facing changes in the provided release information. There are no recorded updates to assess for CRI-O v1.35.4.
Source ↗This release contains operator-facing corrections to container status image references and to debug logging for List* RPC calls. The recorded changes address a correctness issue after CRI-O restarts and reduce log verbosity to improve performance.
cri-o v1.34.9 fixes two correctness defects. The remaining listed headings do not describe operator-facing changes.
Source ↗This cri-o release, v1.33.13, contains a documented operator-facing correctness fix. The fix addresses a race condition that could cause cri-o to report exit code 255 when a container exits quickly.
Source ↗CRI-O v1.36.0 is a substantive operator-facing feature and maintenance release with runtime and operational changes. It also includes a security update to spdystream and a broad dependency refresh.
Action needed (1)
securityhighThe
spdystreamdependency update for CVE-2026-35469CRI-O v1.36.0 updates the
spdystreamdependency to fix CVE-2026-35469.
A maintenance release that adds a runtime metric and a GOMAXPROCS configuration field, fixes two runtime defects, and reverts CNI monitoring after node bootstrapping regressions. It also updates the spdystream dependency to address CVE-2026-35469.
Action needed (2)
securityhighThe
spdystreamdependency update for CVE-2026-35469The
spdystreamdependency is updated to address CVE-2026-35469. The update ships in this release.breakingCRI-O CNI monitoring, reverted
CRI-O reverts CNI monitoring because it caused node bootstrapping regressions. The change ships in this release.
CRI-O v1.34.8 includes a security-relevant dependency update and adds operator-facing observability and configuration capabilities. The dependency update is the release change that requires upgrading, while the other additions concern optional setup or informational use.
Action needed (1)
securityhighCVE-2026-35469 fix in the
spdystreamdependencyCRI-O v1.34.8 updates the
spdystreamdependency to fix CVE-2026-35469.
CRI-O v1.33.12 includes a security fix for a disclosed vulnerability in the spdystream dependency. It also adds the min_injected_gomaxprocs configuration field for controlling the floor of injected GOMAXPROCS values.
Action needed (1)
securityhighCVE-2026-35469 fix in the
spdystreamdependencyCVE-2026-35469 is fixed by updating the
spdystreamdependency in CRI-O v1.33.12.
CRI-O v1.33.11 contains no operator-facing changes in the supplied release material. No specific flags, fields, resources, metrics, or advisories are identified for this version.
Source ↗CRI-O v1.35.2 is an operator-facing maintenance release focused on configuration and runtime behavior. It concerns deployments using artifact stores, pinned images, image pulls, or the affected metrics paths.
Source ↗CRI-O v1.34.7 contains no operator-facing change details in the release note. There are no specific changes to assess for this release.
Source ↗This release includes an operator-facing correctness fix in CRI-O, covering IRQ SMP affinity handling during late container deletion. No standalone change details are provided for display here.
Source ↗CRI-O v1.35.1 adds TLS configuration options and corrects pull and container-runtime defects. The release also includes dependency manifest updates, which are not separately described operator-facing changes.
Source ↗CRI-O v1.34.6 contains no recorded operator-facing changes. No release details are available to assess from the supplied notes.
Source ↗This release contains an operator-facing bug fix for container SELinux labeling. Systemd and init containers now respect a user-specified SELinux label.
Source ↗CRI-O v1.34.5 is a maintenance release. The available release information identifies an operator-facing bug fix, but no individual change details are included here.
Source ↗This release contains no described operator-facing changes. No recorded release-note items indicate changes to configuration, interfaces, or operational behavior.
Source ↗This CRI-O release contains one operator-facing behavior change related to SELinux labels for systemd or init containers. No actionable change details are included here beyond that release-note summary.
Source ↗cri-o v1.34.4 is a correctness-focused maintenance release. It fixes CPU affinity behavior when CPU load balancing is disabled and respects user-specified SELinux labels for systemd or init containers. No security advisories or operator-actionable removals, default changes, or constraint changes are disclosed.
Source ↗