fix(deps): update module github.com/containerd/containerd/v2 to v2.3.5 [security] - #337
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/go-github.com-containerd-containerd-v2-vulnerability
branch
2 times, most recently
from
September 18, 2026 16:42
94574e5 to
0364cd8
Compare
renovate
Bot
force-pushed
the
renovate/go-github.com-containerd-containerd-v2-vulnerability
branch
from
September 24, 2026 08:27
0364cd8 to
207d61c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.3.3→v2.3.5containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
CVE-2026-53495 / GHSA-7jxh-36q5-gcqv
More information
Details
Impact
A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.
Patches
This bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.
Workarounds
Ensure exec probes and lifecycle hooks do not launch long-lived background child processes.
Credits
The containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.
For more information
If there are any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd/v2)
v2.3.5: containerd 2.3.5Compare Source
Welcome to the v2.3.5 release of containerd!
The fifth patch release for containerd 2.3 contains various fixes
and updates including security patches.
Security Updates
Highlights
Image Distribution
Runtime
Snapshotters
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
33 commits
934efa5e0Prepare release notes for v2.3.5be419b070Merge commit from fork9ec55f024cri: cancel ExecSync IO drain on context cancellation84ea25bc1Merge commit from forkc53577965archive: skip redundant opaque whiteout walks9f6be869cFix data races and a deadlock in the byte stream helpers6c59399bfplugins: remove some stray logrus importsf65732115snapshots/erofs: test the advertised erofs feature platform5ffc2bbdaerofs: advertise the erofs OS feature platform from the snapshotteraf445ea0aupdate runc to v1.5.1c077e43bdupdate runc to v1.5.0676a64cadvendor: github.com/containerd/platforms v1.0.0-rc.5c7ffd8b00pkg/tracing: handle error and typed-nil Stringer attributes58fb846d5core/remotes/docker: normalize descriptor URL originsc7625a1ffcore/remotes/docker: strip sensitive headers on desc.urls fetch6fbb92c33update runhcs to v0.15.0-rc.453bf030eapkg/oci: resolve rootfs symlinks for user lookup7790c4c21ensure that the final config version is the higest in the config list1125b053fRevert "add check on version of drop in configs"460c47b28fix(runtime): bound shim loading with the load timeout7f97bc122Add more context to the shim delete errorChanges from containerd/platforms
2 commits
bacc690Fix WS2022 compat on hosts past the latest LTSCDependency Changes
Previous release can be found at v2.3.4
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.3.4: containerd 2.3.4Compare Source
Welcome to the v2.3.4 release of containerd!
The fourth patch release for containerd 2.3 contains various fixes and updates.
Highlights
Container Runtime Interface (CRI)
Node Resource Interface (NRI)
Runtime
Snapshotters
Breaking
Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
35 commits
c1f5360efPrepare release notes for v2.3.4928c03c68cri: disable restore in CreateContainer by default5966e2edbnri,deprecation: emit warnings for old NRI plugins.ab52c58f1Set the default of runtimeFeatures.UserNamespacesHostNetwork to true0c255158actr: add --scrub-logs flag for Windows1c2b13dc9cri/config: use ScrubLogs by default on Windows0c511e068snapshots/erofs: keep lowers stacked above a merged fsmetadc98141dfcri: deprecate restore in CreateContainer537d82d54internal/oom: Fix memory leak by removing watcher from map on Stopdecf97a9cshim_load: Consider shim leaked only if we can't find pids796f07dc8core/runtime/v2: Drop checkpointctl module dependency751fddddbHandle []byte envvar value0bce9060eupdate to v0.36.x kubernetes dependencies61a8f6f45fix(cri): introspect OCI runtime features for non-runc runtimes1d28017becore/runtime/v2: Preserve protobuf shim response bytes374091d67github/workflows: install criu in node-e2edb03e3968cri: add enable_criu configuration optiondacd4c7d0cri: validate CRIU availability and version early890a9c86cci: bound Go fuzzing by execution count0b2f1d078cri: auto-add prefix for pause imageDependency Changes
Previous release can be found at v2.3.3
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.