Skip to content

fix(deps): update module github.com/containerd/containerd/v2 to v2.3.5 [security] - #337

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-github.com-containerd-containerd-v2-vulnerability
Open

renovate[bot] wants to merge 1 commit into
masterfrom
renovate/go-github.com-containerd-containerd-v2-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 10, 2026 •

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/containerd/containerd/v2 v2.3.3 → v2.3.5 age confidence

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

CVE-2026-53495 / GHSA-7jxh-36q5-gcqv

More information

Details

Impact

A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.

Patches

This bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.

Workarounds

Ensure exec probes and lifecycle hooks do not launch long-lived background child processes.

Credits

The containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @​IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.

For more information

If there are any questions or comments about this advisory:

To report a security issue in containerd:

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).


Release Notes

containerd/containerd (github.com/containerd/containerd/v2)

v2.3.5: containerd 2.3.5

Compare Source

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes
and updates including security patches.

Security Updates
Highlights
Image Distribution
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#​14030)
Runtime
  • Avoid hangs and data races when streaming container standard I/O in CRI (#​14094)
  • Fix missing error messages in OpenTelemetry trace attributes (#​14049)
  • Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#​13999)
  • Fix configuration loading error when drop-in configuration files have a higher version than the root configuration (#​13995)
  • Avoid containerd startup hangs when loading shims (#​13983)
  • Add context to error when shim delete times out (#​13921)
  • Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)
Snapshotters
  • Fix unpack failure for EROFS images containing the erofs OS feature (#​14062)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors
  • Phil Estes
  • Samuel Karp
  • Derek McGowan
  • Sebastiaan van Stijn
  • Akhil Mohan
  • Maksym Pavlenko
  • Wei Fu
  • Oleh Konko
  • Austin Vazquez
  • Jing Chen
  • Martín Fernández
  • Paco Xu
  • XlabAI
  • Yuanliang Zhang
Changes
33 commits

  • 934efa5e0 Prepare release notes for v2.3.5
  • be419b070 Merge commit from fork
  • 9ec55f024 cri: cancel ExecSync IO drain on context cancellation
  • 84ea25bc1 Merge commit from fork
  • c53577965 archive: skip redundant opaque whiteout walks
  • Fix data races and a deadlock in the byte stream helpers (#​14094)
    • 9f6be869c Fix data races and a deadlock in the byte stream helpers
  • plugins: remove some stray logrus imports (#​14063)
    • 6c59399bf plugins: remove some stray logrus imports
  • snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#​14062)
    • f65732115 snapshots/erofs: test the advertised erofs feature platform
    • 5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter
  • update runc to v1.5.1 (#​14059)
  • vendor: github.com/containerd/platforms v1.0.0-rc.5 (#​14048)
    • 676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5
  • pkg/tracing: handle error and typed-nil Stringer attributes (#​14049)
    • c7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes
  • docker fetcher: strip sensitive headers on descriptor URLs (#​14030)
    • 58fb846d5 core/remotes/docker: normalize descriptor URL origins
    • c7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch
  • update runhcs to v0.15.0-rc.4 (#​13990)
  • pkg/oci: resolve rootfs symlinks for user lookup (#​13999)
    • 53bf030ea pkg/oci: resolve rootfs symlinks for user lookup
  • Revert "add check on version of drop in configs" (#​13995)
    • 7790c4c21 ensure that the final config version is the higest in the config list
    • 1125b053f Revert "add check on version of drop in configs"
  • fix(runtime): apply load timeout to load shim (#​13983)
    • 460c47b28 fix(runtime): bound shim loading with the load timeout
  • Add more context to the shim delete error (#​13921)
    • 7f97bc122 Add more context to the shim delete error

Changes from containerd/platforms
2 commits

Dependency Changes
  • github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5

Previous release can be found at v2.3.4

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

v2.3.4: containerd 2.3.4

Compare Source

Welcome to the v2.3.4 release of containerd!

The fourth patch release for containerd 2.3 contains various fixes and updates.

Highlights
Container Runtime Interface (CRI)
  • Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#​13913)
  • Set default runtimeFeatures.UserNamespacesHostNetwork to true in CRI (#​13914)
  • Deprecate checkpoint restore in CreateContainer (#​13868)
  • Support non-UTF-8 binary environment variable values in CRI (#​13454)
  • Enable OCI runtime feature introspection for non-runc runtimes in CRI (#​13778)
  • Disable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option (#​13734)
  • Normalize sandbox image references in CRI to resolve images without domain prefixes (#​13759)
Node Resource Interface (NRI)
  • Emit deprecation warnings for plugins using deprecated NRI interfaces (#​13935)
Runtime
  • Enable log scrubbing by default on Windows (#​13904)
  • Fix memory leak in OOM watcher map when stopping container monitoring (#​13870)
  • Avoid orphaning shims on transient errors when loading process IDs (#​13857)
  • Fix corruption of binary protobuf shim start responses caused by premature whitespace trimming (#​13803)
Snapshotters
  • Fix EROFS snapshotter dropping lower layers stacked above merged filesystem metadata (#​13876)
Breaking
  • Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#​13913)
Deprecations
  • Deprecate checkpoint restore in CreateContainer (#​13868)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Maksym Pavlenko
  • Mike Brown
  • Akihiro Suda
  • Derek McGowan
  • Jordan Liggitt
  • Paweł Gronowski
  • Amir Alavi
  • Andrew Halaney
  • Bing Hongtao
  • Chris Henzie
  • Harshal Patel
  • Krisztian Litkey
  • Phil Estes
  • Wei Fu
  • ningmingxiao
Changes
35 commits

  • c1f5360ef Prepare release notes for v2.3.4
  • cri: disable restore in CreateContainer by default (#​13913)
    • 928c03c68 cri: disable restore in CreateContainer by default
  • nri,deprecation: record and emit warnings for NRI deprecations. (#​13935)
    • 5966e2edb nri,deprecation: emit warnings for old NRI plugins.
  • Set the default of runtimeFeatures.UserNamespacesHostNetwork to true (#​13914)
    • ab52c58f1 Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
  • Use ScrubLogs by default on Windows (#​13904)
    • 0c255158a ctr: add --scrub-logs flag for Windows
    • 1c2b13dc9 cri/config: use ScrubLogs by default on Windows
  • snapshots/erofs: keep lowers stacked above a merged fsmeta (#​13876)
    • 0c511e068 snapshots/erofs: keep lowers stacked above a merged fsmeta
  • cri: deprecate restore in CreateContainer (#​13868)
    • dc98141df cri: deprecate restore in CreateContainer
  • internal/oom: Fix memory leak by removing watcher from map on Stop (#​13870)
    • 537d82d54 internal/oom: Fix memory leak by removing watcher from map on Stop
  • shim_load: Consider shim leaked only if we can't find pids (#​13857)
    • decf97a9c shim_load: Consider shim leaked only if we can't find pids
  • core/runtime/v2: Drop checkpointctl module dependency (#​13840)
    • 796f07dc8 core/runtime/v2: Drop checkpointctl module dependency
  • Handle []byte envvar value for CRI (#​13454)
    • 751fddddb Handle []byte envvar value
    • 0bce9060e update to v0.36.x kubernetes dependencies
  • fix(cri): introspect OCI runtime features for non-runc runtimes (#​13778)
    • 61a8f6f45 fix(cri): introspect OCI runtime features for non-runc runtimes
  • core/runtime/v2: Preserve protobuf shim response bytes (#​13803)
    • 1d28017be core/runtime/v2: Preserve protobuf shim response bytes
  • Disable checkpoint restore codepath when CRIU is not installed (#​13734)
    • 374091d67 github/workflows: install criu in node-e2e
    • db03e3968 cri: add enable_criu configuration option
    • dacd4c7d0 cri: validate CRIU availability and version early
  • ci: bound Go fuzzing by execution count (#​13785)
    • 890a9c86c ci: bound Go fuzzing by execution count
  • cri: auto-add prefix for pause image (#​13759)
    • 0b2f1d078 cri: auto-add prefix for pause image

Dependency Changes
  • k8s.io/api v0.36.0 -> v0.36.3
  • k8s.io/apimachinery v0.36.0 -> v0.36.3
  • k8s.io/client-go v0.36.0 -> v0.36.3
  • k8s.io/component-base v0.36.0 -> v0.36.3
  • k8s.io/cri-api v0.36.0 -> v0.36.3
  • k8s.io/cri-client v0.36.0 -> v0.36.3
  • k8s.io/cri-streaming v0.36.0 -> v0.36.3
  • sigs.k8s.io/structured-merge-diff/v6 v6.3.2 -> v6.3.3

Previous release can be found at v2.3.3

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/go-github.com-containerd-containerd-v2-vulnerability branch 2 times, most recently from 94574e5 to 0364cd8 Compare September 18, 2026 16:42
@renovate
renovate Bot force-pushed the renovate/go-github.com-containerd-containerd-v2-vulnerability branch from 0364cd8 to 207d61c Compare September 24, 2026 08:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants