Is containerd 2.3.0 affected?

Vulnerabilities affecting 2.3.0

• 7.3
  CVE-2026-46680 containerd user ID handling bypass allows runAsNonRoot evasion fixed in 2.3.1
• 5.6
  CVE-2026-50195 CRI checkpoint import allows local image tag poisoning fixed in 2.3.2
• medium
  GHSA-8647-2jxj-p2rc containerd: daemon crash when pulling an image with a crafted Content-Length header fixed in 2.3.7
• medium
  CVE-2026-95839 containerd: daemon crash when processing an image manifest with a malformed digest fixed in 2.3.7
• medium
  GHSA-hc94-p972-ch66 containerd: host disk exhaustion when pulling an image with an unbounded layer stream fixed in 2.3.7
• medium
  GHSA-5p7c-hggf-c748 containerd CRI plugin: mount and snapshot leak when container checkpoint restore fails fixed in 2.3.7
• medium
  CVE-2026-53493 Image-pull DoS via crafted OCI index graph amplification fixed in 2.3.6
• medium
  CVE-2026-95838 Unpack DoS via repeated opaque whiteouts fixed in 2.3.5
• medium
  CVE-2026-53495 containerd CRI plugin: Unbounded I/O draining in ExecSync causes node-level denial of service fixed in 2.3.5
• critical
  CVE-2026-95837 containerd CRI plugin: Checkpoint restore bypasses destination security context fixed in 2.3.4
• medium
  CVE-2026-47262 containerd image-triggered runtime DoS via unbounded group parsing fixed in 2.3.2
• high
  CVE-2026-53489 Arbitrary host file read via symlink following in CRI checkpoint restore fixed in 2.3.2
• critical
  CVE-2026-53488 containerd CRI — image-config LABEL flows to host-root command execution from an image pull fixed in 2.3.2
• critical
  CVE-2026-53492 CDI annotation smuggling during CRI checkpoint restore fixed in 2.3.2

Newer releases