# containerd v2.4.2

> Kubernetes Core · 2026-10-13

A security-focused maintenance release with advisory fixes, updated Go and runc components, and hardening changes that can alter accepted behavior. It also fixes image-transfer correctness and resource-usage issues.

## Action needed
- **[security]** `CVE-2026-95839` security advisory
  - The release includes the security advisory `CVE-2026-95839`, also identified as `GHSA-vwhp-8p66-mq4f`.
- **[security]** `GHSA-8647-2jxj-p2rc` security advisory
  - The release includes the security advisory `GHSA-8647-2jxj-p2rc`.
- **[security]** `GHSA-hc94-p972-ch66` security advisory
  - The release includes the security advisory `GHSA-hc94-p972-ch66`.
- **[security]** Go `go1.26.9` and `go1.27.2` updates
  - containerd ships with updates to Go `go1.26.9` and `go1.27.2`.
- **[breaking]** `cri` log-file following behavior
  - The `cri` component no longer follows log files.
- **[breaking]** `reference` path-component validation
  - The `reference` component rejects `..` path components that rewrite the host.
- **[breaking]** `seccomp` socket-domain allow-list
  - `seccomp` uses an allow-list for socket domains.

## Other recorded changes
- 5 (value_changed 4, constraint_changed 1)

[Full analysis](https://ratatosk.io/en/releases/containerd/v2.4.2)

[Original release notes](https://github.com/containerd/containerd/releases/tag/v2.4.2)