containerd 2.2.7 → 2.2.9
2 releases · 0 breaking changes · 3 security fixes · 3 advisories fixed
3security0breaking0deprecated8feature0fix
Vulnerabilities fixed by this upgrade
- medium CVE-2026-53493 Image-pull DoS via crafted OCI index graph amplification
- medium CVE-2026-95838 Unpack DoS via repeated opaque whiteouts
- medium CVE-2026-53495 containerd CRI plugin: Unbounded I/O draining in ExecSync causes node-level denial of service
Breaking changes
None in the release notes.
Security changes
- security CVE-2026-53493 in 2.2.9
- security CVE-2026-53495 in 2.2.8
- security GHSA-rp3h-jf77-q9p4 in 2.2.8
Every release in between
securityCVE-2026-53493
featureFix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ()
featureEnable mount manager for image mounts in CRI ()
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
other60acf78bc5 Prepare release notes for v2.2.9
other253f9cc140 Merge commit from fork
other053c0cc412 Bound Walk references
otherefd11fc9c2 Bound Dispatch concurrency and references
othercri: tolerate wrapped ENOTSUP during relabel ()
other39d0dd4b43 cri: tolerate wrapped ENOTSUP during relabel
otherpkg/oci: mask thermal interrupt info ()
otherbaffef9669 pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other9e1ae6a9e9 core/unpack: fetch layers of every config-sharing manifest
othercri: Backport image mount fixes 2.2 ()
other2cdf8d80cc cri: only unmount image volumes when mounting fails
other2e1dcc5da0 cri: enable mount manager for image mounts
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureFix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ()
featureFix EROFS snapshot creation failure caused by concurrent snapshot removal ()
other4864b1814 Prepare release notes for v2.2.8
other3458b7fd3 Merge commit from fork
other22ccf4314 cri: cancel ExecSync IO drain on context cancellation
other2bf01ce17 Merge commit from fork
other45166eb82 archive: skip redundant opaque whiteout walks
otherSet SystemTemp env var to config temp on Windows ()
other2c722ad04 Set SystemTemp env var to config temp on Windows
otherpkg/oci: resolve rootfs symlinks for user lookup ()
other196664bc0 pkg/oci: resolve rootfs symlinks for user lookup
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other6da9d9528 core/remotes/docker: normalize descriptor URL origins
other4f7851699 core/remotes/docker: strip sensitive headers on desc.urls fetch
othersnapshots/erofs: protect snapshot staging from cleanup ()
otherf7075a224 snapshots/erofs: protect snapshot staging from cleanup