# containerd v2.3.7

> Kubernetes Core · 2026-10-13

Security fixes lead this maintenance release, alongside runtime hardening and correctness changes. Dependency updates alter some default behavior, and the release includes updates to runtime components.

## Action needed
- **[security]** `CVE-2026-95839` and `GHSA-vwhp-8p66-mq4f`
  - `CVE-2026-95839` and `GHSA-vwhp-8p66-mq4f` are addressed in this containerd release.
- **[security]** `GHSA-5p7c-hggf-c748`
  - `GHSA-5p7c-hggf-c748` is addressed in this containerd release.
- **[security]** `GHSA-8647-2jxj-p2rc`
  - `GHSA-8647-2jxj-p2rc` is addressed in this containerd release.
- **[security]** `GHSA-hc94-p972-ch66`
  - `GHSA-hc94-p972-ch66` is addressed in this containerd release.
- **[breaking]** `cri` log-file following behavior
  - `cri` no longer follows the log file in this containerd release.
- **[breaking]** `reference` path traversal rejection
  - `reference` now rejects `..` path components that rewrite the host.
- **[breaking]** `seccomp` socket-domain allow-list
  - `seccomp` now uses an allow-list for socket domains.

## Other recorded changes
- 8 (value_changed 3, constraint_changed 3, defect_corrected 2)

[Full analysis](https://ratatosk.io/en/releases/containerd/v2.3.7)

[Original release notes](https://github.com/containerd/containerd/releases/tag/v2.3.7)