LoginSign Up
← Back to all sparks
C

containerd

DEVOPS
Velocity5.0

Industry-standard container runtime

containerd.io ↗

containerd ships four security advisories and a tighter default seccomp across four branches

container-runtimesecurity-hardeningseccompcrikubernetes
◆Current state
containerd maintains five release branches: 1.7, 2.0, 2.2, 2.3 LTS and 2.4. On October 13 it patched 2.0 through 2.4 for CVE-2026-95839 and three GHSA advisories, three weeks after the CVE-2026-53493 round. The fixes harden inputs an attacker can control: container log symlinks are no longer followed, image references containing '..' are rejected, ID-mapping labels are filtered from image annotations, and the default seccomp profile now allowlists socket domains.
◆Where it's heading
Two coordinated multi-branch security rounds in three weeks show maintenance shifting toward closing untrusted-input paths in image references, annotations and log files. The seccomp allowlist is the one change that can alter runtime behavior, since workloads opening uncommon socket families may now be blocked by default. Feature work stays on 2.4, whose patch line is also fixing pull-time memory growth.
◆Prediction
Expect a 1.7 patch with whichever of these fixes apply there, since every other branch moved the same day. The entries don't show whether the seccomp socket allowlist will need follow-up exceptions.

◆Recent moves

  1. 15d ago

    containerd 2.3.7

    The 2.3 LTS patch closes CVE-2026-95839 and three GHSA advisories with four hardening changes, including a socket-domain allowlist in the default seccomp profile. LTS users get the full set, and the seccomp change is the part that can affect running workloads.

    View source ↗
  2. 15d ago

    containerd 2.2.10

    2.2.10 carries the same security hardening plus a fix for hangs and data corruption during multipart image fetches. The fetch fix is the one users would have felt directly; the rest closes untrusted-input paths in log files, image references and annotations.

    View source ↗
  3. 15d ago

    containerd 2.4.2

    The second 2.4 patch applies the CVE-2026-95839 hardening and fixes excessive memory use when registry downloads outpace content writes. The memory fix shows the newest branch still settling under real pull workloads.

    View source ↗
  4. 15d ago

    containerd 2.0.14

    2.0.14 backports a narrower subset, one GHSA and three hardening changes, to the oldest 2.x branch. It is maintenance for operators who haven't moved to 2.3 LTS.

    View source ↗
  5. 1mo ago

    containerd 1.7.36

    Thirty-sixth patch to the 1.7 LTS branch closes CVE-2026-53493 and backports the multi-manifest layer-fetch fix. Routine security maintenance on the long-term stable line — no new behavior.

    View source ↗
  6. 1mo ago

    containerd 2.4.1

    First patch to the freshly-released 2.4 branch; CVE-2026-53493 and a CRI fix for failed container creation. Standard security maintenance on a new minor — no behavior changes beyond the fix.

    View source ↗