This release fixes user-namespace UID/GID restoration after CRI-O restart, reduces debug-log verbosity for List* RPC calls, and restores pre-1.34 handling of environment-variable values containing non-UTF-8 data. It also updates or removes dependencies listed in the dependency manifest.
Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
CRI-O v1.34.11 includes a correctness fix that restores prior handling of environment-variable values containing non-UTF-8 data. No detailed change item is provided here.
Source ↗This cri-o release includes a fix for a disclosed security vulnerability alongside runtime behavior, monitoring configuration, metric, and dependency updates. It is most relevant to deployments affected by the HOME environment-variable issue or the related observability and CNI configuration changes.
Action needed (1)
securityhighCVE-2026-15809 HOME environment-variable injection fix
cri-o v1.36.3 fixes CVE-2026-15809. The vulnerability allowed a bypass of the CVE-2022-4318 fix, enabling
/etc/passwdinjection through newline characters in theHOMEenvironment variable.