# containerd v2.2.10

> Kubernetes Core · 2026-10-13

A security-focused maintenance release with advisory fixes, runtime hardening, correctness fixes, and a Go toolchain update that changes several default protections. It also includes multipart fetch stability work, CRI log handling corrections, and unpack behavior changes.

## Action needed
- **[security]** `CVE-2026-95839` correction
  - `containerd` v2.2.10 includes a correction for `CVE-2026-95839`, also tracked as `GHSA-vwhp-8p66-mq4f`.
- **[security]** `GHSA-8647-2jxj-p2rc` correction
  - `containerd` v2.2.10 includes a correction for `GHSA-8647-2jxj-p2rc`.
- **[security]** `GHSA-hc94-p972-ch66` correction
  - `containerd` v2.2.10 includes a correction for `GHSA-hc94-p972-ch66`.
- **[breaking]** Host-rewriting `..` path components rejected
  - The `reference` handling in `containerd` v2.2.10 rejects `..` path components that rewrite the host.
- **[breaking]** `seccomp` socket-domain allow-list
  - The `seccomp` configuration in `containerd` v2.2.10 uses an allow-list for socket domains.

## Other recorded changes
- 4 (value_changed 3, defect_corrected 1)

[Full analysis](https://ratatosk.io/en/releases/containerd/v2.2.10)

[Original release notes](https://github.com/containerd/containerd/releases/tag/v2.2.10)