Update module github.com/containerd/containerd/v2 to v2.3.6 [SECURITY] (main) by renovate[bot] · Pull Request #3605 · conforma/cli

renovate · 2026-10-13T18:12:29Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/containerd/containerd/v2	`v2.3.4` → `v2.3.6`

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

CVE-2026-53495 / GHSA-7jxh-36q5-gcqv

More information

Details

Impact

A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.

Patches

This bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.

Workarounds

Ensure exec probes and lifecycle hooks do not launch long-lived background child processes.

Credits

The containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.

For more information

If there are any questions or comments about this advisory:

Open an issue in containerd
Send an email to security@containerd.io

To report a security issue in containerd:

Report a new vulnerability
Send an email to security@containerd.io

Severity

CVSS Score: 6.8 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Containerd has image-pull DoS via crafted OCI index graph amplification

CVE-2026-53493 / GHSA-pg57-6jwg-q645

More information

Details

Impact

A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the PullImage operation, the recursive traversal and processing of child descriptors lack sufficient depth and breadth limits, and fail to adequately deduplicate identical descriptors. This unbounded traversal leads to excessive resource allocation.

Consequently, pulling a malicious image reference can result in prolonged stalls during container creation and significant resource pressure on the host system. This issue occurs entirely during the image pull phase, prior to any container execution.

Patches

This bug has been fixed in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36. Users should update to these versions to resolve the issue.

Workarounds

There are no known workarounds for this issue. Users are advised to only pull trusted images from known registries until the patch can be applied.

Credits

The containerd project would like to thank Jakub Ciolek at ElevenLabs and @jlgore who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

Open an issue in containerd
Email us at security@containerd.io

To report a security issue in containerd:

Report a new vulnerability
Email us at security@containerd.io

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

containerd/containerd (github.com/containerd/containerd/v2)

`v2.3.6`: containerd 2.3.6

Compare Source

Welcome to the v2.3.6 release of containerd!

The sixth patch release for containerd 2.3 contains various fixes
and updates including a security patch.

Security Updates

containerd
- CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#14211)
Enable mount manager for image mounts in CRI (#14147)

Image Storage

Ensure all layers are fetched when multiple manifests in an index share a config descriptor (#14139)

Runtime

Avoid unexpected mutation of mount options in mount helpers (#14192)
Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14144)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Paweł Gronowski
Samuel Karp
Chris Henzie
Maksym Pavlenko
Wei Fu
Gao Xiang
Nan Liu

Changes

26 commits

086fc0d40e Prepare release notes for v2.3.6
3e3b3daabc Merge commit from fork
03fbef37da Bound Walk references
bfe167214b Bound Dispatch concurrency and references
Fix input mutation in mount option helpers (#14192)
- 5f17a29a9b core/mount: Keep lazy copy for filtered options
- 49796574fb core/mount: Return copied filtered mount options
- cb3f358aea mount: share lazy option filtering
- ee7ae5b7c7 mount: fix shallow copy of Options in RemoveVolatileOption and RemoveIDMapOption
- 1facedfb21 mount: fix input mutation in readonlyMounts
- 5ca695a441 mount: replace copyMounts with slices.Clone
cri: tolerate wrapped ENOTSUP during relabel (#14211)
- 7fd198f858 cri: tolerate wrapped ENOTSUP during relabel
release: don't mark 2.3 releases as latest (#14180)
- 147edce99f release: don't mark 2.3 releases as latest
cri: Backport image mount fixes 2.3 (#14147)
- c2c5164437 cri: only unmount image volumes when mounting fails
- 74d0c79682 cri: enable mount manager for image mounts
core/unpack: fetch layers of every config-sharing manifest (#14139)
- 4a3a41d353 core/unpack: fetch layers of every config-sharing manifest
pkg/oci: mask thermal interrupt info (#14144)
- 9c6d7e9509 pkg/oci: mask thermal interrupt info
Update to go1.26.8 (#14088)
- ac4464a399 Update to go1.26.8
- f7f64ddc06 Update to go1.26.7
- 902a7d5e6c Update to go1.26.6

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.3.5

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

`v2.3.5`: containerd 2.3.5

Compare Source

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes
and updates including security patches.

Security Updates

containerd
- CVE-2026-53495
- GHSA-rp3h-jf77-q9p4

Highlights

Image Distribution

Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14030)

Runtime

Avoid hangs and data races when streaming container standard I/O in CRI (#14094)
Fix missing error messages in OpenTelemetry trace attributes (#14049)
Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13999)
Fix configuration loading error when drop-in configuration files have a higher version than the root configuration (#13995)
Avoid containerd startup hangs when loading shims (#13983)
Add context to error when shim delete times out (#13921)
Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)

Snapshotters

Fix unpack failure for EROFS images containing the erofs OS feature (#14062)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Phil Estes
Samuel Karp
Derek McGowan
Sebastiaan van Stijn
Akhil Mohan
Maksym Pavlenko
Wei Fu
Oleh Konko
Austin Vazquez
Jing Chen
Martín Fernández
Paco Xu
XlabAI
Yuanliang Zhang

Changes

33 commits

934efa5e0 Prepare release notes for v2.3.5
be419b070 Merge commit from fork
9ec55f024 cri: cancel ExecSync IO drain on context cancellation
84ea25bc1 Merge commit from fork
c53577965 archive: skip redundant opaque whiteout walks
Fix data races and a deadlock in the byte stream helpers (#14094)
- 9f6be869c Fix data races and a deadlock in the byte stream helpers
plugins: remove some stray logrus imports (#14063)
- 6c59399bf plugins: remove some stray logrus imports
snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#14062)
- f65732115 snapshots/erofs: test the advertised erofs feature platform
- 5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter
update runc to v1.5.1 (#14059)
- af445ea0a update runc to v1.5.1
- c077e43bd update runc to v1.5.0
vendor: github.com/containerd/platforms v1.0.0-rc.5 (#14048)
- 676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5
pkg/tracing: handle error and typed-nil Stringer attributes (#14049)
- c7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes
docker fetcher: strip sensitive headers on descriptor URLs (#14030)
- 58fb846d5 core/remotes/docker: normalize descriptor URL origins
- c7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch
update runhcs to v0.15.0-rc.4 (#13990)
- 6fbb92c33 update runhcs to v0.15.0-rc.4
pkg/oci: resolve rootfs symlinks for user lookup (#13999)
- 53bf030ea pkg/oci: resolve rootfs symlinks for user lookup
Revert "add check on version of drop in configs" (#13995)
- 7790c4c21 ensure that the final config version is the higest in the config list
- 1125b053f Revert "add check on version of drop in configs"
fix(runtime): apply load timeout to load shim (#13983)
- 460c47b28 fix(runtime): bound shim loading with the load timeout
Add more context to the shim delete error (#13921)
- 7f97bc122 Add more context to the shim delete error

Changes from containerd/platforms

2 commits

Fix WS2022 compat on hosts past the latest LTSC (containerd/platforms#34)
- bacc690 Fix WS2022 compat on hosts past the latest LTSC

Dependency Changes

github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5

Previous release can be found at v2.3.4

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-10-13T18:12:34Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.26.7` -> `1.26.8`

coderabbitai · 2026-10-13T18:12:39Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 5418fa29-38f6-4a99-8f67-44a8d0fc3333

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

fullsend-ai-review · 2026-10-13T18:21:28Z