{"data":{"items":[{"id":"3f62b40b-b44d-4e89-a2e3-42ea382557bc","excerpt":"Update module github.com/containerd/containerd to v1.7.36 [SECURITY] — > [!NOTE]\n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---","url":"https://github.com/infratographer/load-balancer-api/pull/409","role":"pain","weight":1.531918,"occurredAt":"2026-10-13T16:07:33.000Z","sourceKey":"github","sourceName":"GitHub","credibility":0.78,"venue":"infratographer/load-balancer-api","intent":"feature_request","painScore":0.7760038,"sentiment":-1,"confidence":0.8625646,"matchedPatterns":["missing_feature","workaround","manual_process","product:kubernetes"],"statement":"##### Workarounds The system administrator on the host can manually chmod the directories to not have group or world accessible permisisons: An alternative mitigation would be to run containerd in rootless mode.","title":"Update module github.com/containerd/containerd to v1.7.36 [SECURITY]","body":"> [!NOTE]\n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) | `v1.7.12` → `v1.7.36` |  |  |\n\n---\n\n### containerd has an integer overflow in User ID handling\n[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) / [GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.\n\n##### Patches\nThis bug has been fixed in the following containerd versions: \n\n* 2.0.4 (Fixed in https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20)\n* 1.7.27 (Fixed in https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da)\n* 1.6.38 (Fixed in https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a)\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images.\n\n##### Credits\nThe containerd project would like to thank [Benjamin Koltermann](https://redirect.github.com/p4ck3t0) and [emxll](https://redirect.github.com/emxll) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### References\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 4.6 / 10 (Medium)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)\n- [https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da](https://redirect.github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da)\n- [https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20](https://redirect.github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20)\n- [https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a](https://redirect.github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635)\n- [https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html](https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html)\n- [https://github.com/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd affected by a local privilege escalation via wide permissions on CRI directory\n[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) / [GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nAn overly broad default permission vulnerability was found in containerd.\n\n- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700\n - Allowed local users on the host to potentially access the metadata store and the content store\n- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700\n - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.\n- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700\n\nThe directory paths may differ depending on the daemon configuration.\nWhen the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\nThese updates automatically change the permissions of the existing directories.\n\n> [!NOTE]\n>\n> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711.\n> This is an expected behavior for supporting userns-remapped containers.\n\n##### Workarounds\n\nThe system administrator on the host can manually chmod the directories to not \nhave group or world accessible permisisons:\n\n```\nchmod 700 /var/lib/containerd\nchmod 700 /run/containerd/io.containerd.grpc.v1.cri\nchmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim\n```\n\nAn alternative mitigation would be to run containerd in [rootless mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).\n\n##### Credits\n\nThe containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)\n- [https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5](https://redirect.github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)\n- [https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md)\n- [https://github.com/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd CRI server: Host memory exhaustion through Attach goroutine leak\n[CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) / [GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nA bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. \n\nRepetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\n\nSet up an admission controller to control accesses to `pods/attach` resources.\ne.g., [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).\n\n##### Credits\n\nThe containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### References\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 6.9 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)\n- [https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df](https://redirect.github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df)\n- [https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329)\n- [https://github.com/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd image-triggered runtime DoS via unbounded group parsing\n[CVE-2026-47262](https://nvd.nist.gov/vuln/detail/CVE-2026-47262) / [GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)\n\n\nMore information
\n\n#### Details\n##### Impact\nA vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.2\n* 2.2.5\n* 2.1.9\n* 2.0.10\n* 1.7.33\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images or schedule pods. \n\n##### Credits\n\nThe containerd project would like to thank Jakub Ciolek (@jake-ciolek) at AlphaSense and Kyle Elliott @ Trail of Bits who independently discovered and responsibly disclosed this issue in accorda","authorHash":"d27744aebf78eca78573f287153aa465","rating":null,"offTopic":true},{"id":"4d5446c6-1583-4d2d-8da7-6995152dfa6c","excerpt":"chore(deps): update module github.com/containerd/containerd to v1.7.36 [security] — > [!NOTE]\n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confiden","url":"https://github.com/komailo/kubeit/pull/90","role":"pain","weight":1.5062336,"occurredAt":"2026-10-13T12:04:24.000Z","sourceKey":"github","sourceName":"GitHub","credibility":0.78,"venue":"komailo/kubeit","intent":"feature_request","painScore":0.7760038,"sentiment":-1,"confidence":0.8481027,"matchedPatterns":["missing_feature","workaround","manual_process","product:kubernetes"],"statement":"##### Workarounds The system administrator on the host can manually chmod the directories to not have group or world accessible permisisons: An alternative mitigation would be to run containerd in rootless mode.","title":"chore(deps): update module github.com/containerd/containerd to v1.7.36 [security]","body":"> [!NOTE]\n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|---|---|\n| [github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) | `v1.7.27` → `v1.7.36` |  |  |  |  |\n\n---\n\n### containerd affected by a local privilege escalation via wide permissions on CRI directory\n[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) / [GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nAn overly broad default permission vulnerability was found in containerd.\n\n- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700\n - Allowed local users on the host to potentially access the metadata store and the content store\n- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700\n - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.\n- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700\n\nThe directory paths may differ depending on the daemon configuration.\nWhen the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\nThese updates automatically change the permissions of the existing directories.\n\n> [!NOTE]\n>\n> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711.\n> This is an expected behavior for supporting userns-remapped containers.\n\n##### Workarounds\n\nThe system administrator on the host can manually chmod the directories to not \nhave group or world accessible permisisons:\n\n```\nchmod 700 /var/lib/containerd\nchmod 700 /run/containerd/io.containerd.grpc.v1.cri\nchmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim\n```\n\nAn alternative mitigation would be to run containerd in [rootless mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).\n\n##### Credits\n\nThe containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)\n- [https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5](https://redirect.github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)\n- [https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md)\n- [https://github.com/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd CRI server: Host memory exhaustion through Attach goroutine leak\n[CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) / [GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nA bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. \n\nRepetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\n\nSet up an admission controller to control accesses to `pods/attach` resources.\ne.g., [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).\n\n##### Credits\n\nThe containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### References\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 6.9 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)\n- [https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df](https://redirect.github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df)\n- [https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329)\n- [https://github.com/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd user ID handling bypass allows runAsNonRoot evasion\n[CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680) / [GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where containers launched with a numeric `User` directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an `/etc/passwd` file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes `runAsNonRoot` restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.1\n* 2.2.4\n* 2.0.9\n* 1.7.32\n\nNote: The containerd 2.1 release has reached its [end of life](https://containerd.io/releases/#current-state-of-containerd-releases) and a fixed version is not provided.\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric `runAsUser` in the Kubernetes Pod `securityContext` overrides the `USER` directive in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforce `runAsNonRoot` properly regardless of this bug.\n\n##### Credits\nThe containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### Resources\n* https://github.com/advisories/GHSA-265r-hfxg-fhmg (CVE-2024-40635)\n\n##### For more information\n\nIf there are any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680)\n- [https://github.com/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd image-triggered runtime DoS via unbounded group parsing\n[CVE-2026-47262](https://nvd.nist.gov/vuln/detail/CVE-2026-47262) / [GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)\n\n\nMore information
\n\n#### Details\n##### Impact\nA vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.2\n* 2.2.5\n* 2.1.9\n* 2.0.10\n* 1.7.33\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images or schedule pods. \n\n##### Credits\n\nThe containerd project would like to thank Jakub Ciolek (@jake-ciolek) at AlphaSense and Kyle Elliott @ Trail of Bits who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://redi","authorHash":"d27744aebf78eca78573f287153aa465","rating":null,"offTopic":true},{"id":"2cd3ab1c-9528-4d29-9ef3-f53a2a1530e7","excerpt":"chore(deps): update module github.com/containerd/containerd to v1.7.35 [security] — > ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge","url":"https://github.com/rancher/Rancher-Plugin-gMSA/pull/104","role":"pain","weight":1.505611,"occurredAt":"2026-09-21T04:41:04.000Z","sourceKey":"github","sourceName":"GitHub","credibility":0.78,"venue":"rancher/Rancher-Plugin-gMSA","intent":"feature_request","painScore":0.7752697,"sentiment":-1,"confidence":0.8481027,"matchedPatterns":["missing_feature","workaround","manual_process","product:kubernetes"],"statement":"##### Workarounds The system administrator on the host can manually chmod the directories to not have group or world accessible permisisons: An alternative mitigation would be to run containerd in rootless mode.","title":"chore(deps): update module github.com/containerd/containerd to v1.7.35 [security]","body":"> ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) | `v1.7.11` → `v1.7.35` |  |  |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check the warning logs for more information.\n\n---\n\n### containerd has an integer overflow in User ID handling\n[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) / [GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg) / [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.\n\n##### Patches\nThis bug has been fixed in the following containerd versions: \n\n* 2.0.4 (Fixed in https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20)\n* 1.7.27 (Fixed in https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da)\n* 1.6.38 (Fixed in https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a)\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images.\n\n##### Credits\nThe containerd project would like to thank [Benjamin Koltermann](https://redirect.github.com/p4ck3t0) and [emxll](https://redirect.github.com/emxll) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### References\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 4.6 / 10 (Medium)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635)\n- [https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da](https://redirect.github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da)\n- [https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20](https://redirect.github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20)\n- [https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a](https://redirect.github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a)\n- [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)\n- [https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html](https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html)\n\nThis data is provided by [OSV](https://osv.dev/vulnerability/GHSA-265r-hfxg-fhmg) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd has an integer overflow in User ID handling in github.com/containerd/containerd\n[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) / [GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg) / [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528)\n\n\nMore information
\n\n#### Details\ncontainerd has an integer overflow in User ID handling in github.com/containerd/containerd\n\n#### Severity\nUnknown\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)\n- [https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da](https://redirect.github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da)\n- [https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20](https://redirect.github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20)\n- [https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a](https://redirect.github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a)\n\nThis data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-3528) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).\n \n\n---\n\n### containerd CRI server: Host memory exhaustion through Attach goroutine leak\n[CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) / [GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2) / [GO-2025-4108](https://pkg.go.dev/vuln/GO-2025-4108)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nA bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. \n\nRepetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\n\nSet up an admission controller to control accesses to `pods/attach` resources.\ne.g., [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).\n\n##### Credits\n\nThe containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### References\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 6.9 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)\n- [https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329)\n- [https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df](https://redirect.github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df)\n- [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)\n\nThis data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m6hq-p25p-ffr2) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd affected by a local privilege escalation via wide permissions on CRI directory\n[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) / [GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w) / [GO-2025-4100](https://pkg.go.dev/vuln/GO-2025-4100)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nAn overly broad default permission vulnerability was found in containerd.\n\n- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700\n - Allowed local users on the host to potentially access the metadata store and the content store\n- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700\n - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.\n- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700\n\nThe directory paths may differ depending on the daemon configuration.\nWhen the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\nThese updates automatically change the permissions of the existing directories.\n\n> [!NOTE]\n>\n> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711.\n> This is an expected behavior for supporting userns-remapped containers.\n\n##### Workarounds\n\nThe system administrator on the host can manually chmod the directories to not \nhave group or world accessible permisisons:\n\n```\nchmod 700 /var/lib/containerd\nchmod 700 /run/containerd/io.containerd.grpc.v1.cri\nchmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim\n```\n\nAn alternative mitigation would be to run containerd in [rootless mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).\n\n##### Credits\n\nThe containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)\n- [https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77","authorHash":"97efb44525414c3936f20054d6e3e18e","rating":null,"offTopic":true},{"id":"da298513-97d1-488f-b73b-e36cfb31d600","excerpt":"Update module github.com/containerd/containerd to v1.7.36 [SECURITY] — > [!NOTE]\n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---","url":"https://github.com/katter/weave-gitops-enterprise/pull/34","role":"pain","weight":1.5047785,"occurredAt":"2026-10-15T04:04:20.000Z","sourceKey":"github","sourceName":"GitHub","credibility":0.78,"venue":"katter/weave-gitops-enterprise","intent":"feature_request","painScore":0.7742881,"sentiment":-1,"confidence":0.8481027,"matchedPatterns":["missing_feature","workaround","manual_process","product:kubernetes"],"statement":"##### Workarounds The system administrator on the host can manually chmod the directories to not have group or world accessible permisisons: An alternative mitigation would be to run containerd in rootless mode.","title":"Update module github.com/containerd/containerd to v1.7.36 [SECURITY]","body":"> [!NOTE]\n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) | `v1.7.0` → `v1.7.36` |  |  |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check the Dependency Dashboard for more information.\n\n---\n\n### containerd allows RAPL to be accessible to a container\n[GHSA-7ww5-4wqc-m92c](https://redirect.github.com/advisories/GHSA-7ww5-4wqc-m92c)\n\n\nMore information
\n\n#### Details\n##### /sys/devices/virtual/powercap accessible by default to containers\n\nIntel's RAPL (Running Average Power Limit) feature, introduced by the Sandy Bridge microarchitecture, provides software insights into hardware energy consumption. To facilitate this, Intel introduced the powercap framework in Linux kernel 3.13, which reads values via relevant MSRs (model specific registers) and provides unprivileged userspace access via `sysfs`. As RAPL is an interface to access a hardware feature, it is only available when running on bare metal with the module compiled into the kernel.\n\nBy 2019, it was realized that in some cases unprivileged access to RAPL readings could be exploited as a power-based side-channel against security features including AES-NI (potentially inside a SGX enclave) and KASLR (kernel address space layout randomization). Also known as the [PLATYPUS attack](https://platypusattack.com/), Intel assigned [CVE-2020-8694](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8694) and [CVE-2020-8695](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8695), and AMD assigned [CVE-2020-12912](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12912).\n\nSeveral mitigations were applied; Intel reduced the sampling resolution via a microcode update, and the Linux kernel [prevents access by non-root users](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=949dd0104c496fa7c14991a23c03c62e44637e71) since 5.10. However, this kernel-based mitigation does not apply to many container-based scenarios:\n* Unless using user namespaces, root inside a container has the same level of privilege as root outside the container, but with a slightly more narrow view of the system\n* `sysfs` is mounted inside containers read-only; however only read access is needed to carry out this attack on an unpatched CPU\n\nWhile this is not a direct vulnerability in container runtimes, defense in depth and safe defaults are valuable and preferred, especially as this poses a risk to multi-tenant container environments. This is provided by masking `/sys/devices/virtual/powercap` in the default mount configuration, and adding an additional set of rules to deny it in the default AppArmor profile.\n\nWhile `sysfs` is not the only way to read from the RAPL subsystem, other ways of accessing it require additional capabilities such as `CAP_SYS_RAWIO` which is not available to containers by default, or `perf` paranoia level less than 1, which is a non-default kernel tunable.\n\n##### References\n\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8694\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8695\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12912\n* https://platypusattack.com/\n* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=949dd0104c496fa7c14991a23c03c62e44637e71\n* https://web.eece.maine.edu/~vweaver/projects/rapl/\n\n#### Severity\nMedium\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)\n- [https://github.com/containerd/containerd/commit/67d356cb3095f3e8f8ad7d36f9a733fea1e7e28c](https://redirect.github.com/containerd/containerd/commit/67d356cb3095f3e8f8ad7d36f9a733fea1e7e28c)\n- [https://github.com/containerd/containerd/commit/746b910f05855c8bfdb4415a1c0f958b234910e5](https://redirect.github.com/containerd/containerd/commit/746b910f05855c8bfdb4415a1c0f958b234910e5)\n- [https://github.com/advisories/GHSA-7ww5-4wqc-m92c](https://redirect.github.com/advisories/GHSA-7ww5-4wqc-m92c)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-7ww5-4wqc-m92c) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd has an integer overflow in User ID handling\n[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) / [GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.\n\n##### Patches\nThis bug has been fixed in the following containerd versions: \n\n* 2.0.4 (Fixed in https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20)\n* 1.7.27 (Fixed in https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da)\n* 1.6.38 (Fixed in https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a)\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images.\n\n##### Credits\nThe containerd project would like to thank [Benjamin Koltermann](https://redirect.github.com/p4ck3t0) and [emxll](https://redirect.github.com/emxll) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### References\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 4.6 / 10 (Medium)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)\n- [https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da](https://redirect.github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da)\n- [https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20](https://redirect.github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20)\n- [https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a](https://redirect.github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635)\n- [https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html](https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html)\n- [https://github.com/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd affected by a local privilege escalation via wide permissions on CRI directory\n[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) / [GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nAn overly broad default permission vulnerability was found in containerd.\n\n- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700\n - Allowed local users on the host to potentially access the metadata store and the content store\n- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700\n - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.\n- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700\n\nThe directory paths may differ depending on the daemon configuration.\nWhen the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\nThese updates automatically change the permissions of the existing directories.\n\n> [!NOTE]\n>\n> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711.\n> This is an expected behavior for supporting userns-remapped containers.\n\n##### Workarounds\n\nThe system administrator on the host can manually chmod the directories to not \nhave group or world accessible permisisons:\n\n```\nchmod 700 /var/lib/containerd\nchmod 700 /run/containerd/io.containerd.grpc.v1.cri\nchmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim\n```\n\nAn alternative mitigation would be to run containerd in [rootless mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).\n\n##### Credits\n\nThe containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)\n- [https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5](https://redirect.github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)\n- [https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md)\n- [https://github.com/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.gi","authorHash":"d27744aebf78eca78573f287153aa465","rating":null,"offTopic":true},{"id":"126be1a7-5149-4ba8-821e-c92195684999","excerpt":"Update module github.com/containerd/containerd to v1.7.35 [SECURITY] (main) — > ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confi","url":"https://github.com/rancher/dartboard/pull/255","role":"pain","weight":1.4503952,"occurredAt":"2026-09-21T04:44:05.000Z","sourceKey":"github","sourceName":"GitHub","credibility":0.78,"venue":"rancher/dartboard","intent":"feature_request","painScore":0.7752697,"sentiment":-1,"confidence":0.817,"matchedPatterns":["missing_feature","workaround","manual_process","product:kubernetes"],"statement":"##### Workarounds The system administrator on the host can manually chmod the directories to not have group or world accessible permisisons: An alternative mitigation would be to run containerd in rootless mode.","title":"Update module github.com/containerd/containerd to v1.7.35 [SECURITY] (main)","body":"> ℹ️ **Note**\n> \n> This PR body was truncated due to platform limits.\n\nThis PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) | `v1.7.28` → `v1.7.35` |  |  |\n\n---\n\n### containerd CRI server: Host memory exhaustion through Attach goroutine leak\n[CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) / [GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2) / [GO-2025-4108](https://pkg.go.dev/vuln/GO-2025-4108)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nA bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. \n\nRepetitive calls of CRI Attach (e.g., [`kubectl attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/)) could increase the memory usage of containerd.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\n\nSet up an admission controller to control accesses to `pods/attach` resources.\ne.g., [Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).\n\n##### Credits\n\nThe containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### References\n\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 6.9 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)\n- [https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329)\n- [https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df](https://redirect.github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df)\n- [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)\n\nThis data is provided by [OSV](https://osv.dev/vulnerability/GHSA-m6hq-p25p-ffr2) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd affected by a local privilege escalation via wide permissions on CRI directory\n[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) / [GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w) / [GO-2025-4100](https://pkg.go.dev/vuln/GO-2025-4100)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nAn overly broad default permission vulnerability was found in containerd.\n\n- `/var/lib/containerd` was created with the permission bits 0o711, while it should be created with 0o700\n - Allowed local users on the host to potentially access the metadata store and the content store\n- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755, while it should be created with 0o700\n - Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.\n- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created with 0o711, while it should be created with 0o700\n\nThe directory paths may differ depending on the daemon configuration.\nWhen the `temp` directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.\n\n##### Patches\n\nThis bug has been fixed in the following containerd versions:\n\n* 2.2.0\n* 2.1.5\n* 2.0.7\n* 1.7.29\n\nUsers should update to these versions to resolve the issue.\nThese updates automatically change the permissions of the existing directories.\n\n> [!NOTE]\n>\n> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task` are still created with 0o711.\n> This is an expected behavior for supporting userns-remapped containers.\n\n##### Workarounds\n\nThe system administrator on the host can manually chmod the directories to not \nhave group or world accessible permisisons:\n\n```\nchmod 700 /var/lib/containerd\nchmod 700 /run/containerd/io.containerd.grpc.v1.cri\nchmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim\n```\n\nAn alternative mitigation would be to run containerd in [rootless mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).\n\n##### Credits\n\nThe containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)\n- [https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5](https://redirect.github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5)\n- [https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)\n- [https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md)\n\nThis data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pwhc-rpq9-4c8w) and the [GitHub Advisory Database](https://redirect.github.com/github/advisory-database) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd\n[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) / [GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w) / [GO-2025-4100](https://pkg.go.dev/vuln/GO-2025-4100)\n\n\nMore information
\n\n#### Details\ncontainerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd\n\n#### Severity\nUnknown\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)\n- [https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)\n- [https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5](https://redirect.github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5)\n- [https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md)\n\nThis data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-4100) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).\n \n\n---\n\n### containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd\n[CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) / [GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2) / [GO-2025-4108](https://pkg.go.dev/vuln/GO-2025-4108)\n\n\nMore information
\n\n#### Details\ncontainerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd\n\n#### Severity\nUnknown\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)\n- [https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329)\n- [https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df](https://redirect.github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df)\n\nThis data is provided by [OSV](https://osv.dev/vulnerability/GO-2025-4108) and the [Go Vulnerability Database](https://redirect.github.com/golang/vulndb) ([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).\n \n\n---\n\n### containerd user ID handling bypass allows runAsNonRoot evasion\n[CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680) / [GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w) / [GO-2026-5378](https://pkg.go.dev/vuln/GO-2026-5378)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where containers launched with a numeric `User` directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an `/etc/passwd` file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes `runAsNonRoot` restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.1\n* 2.2.4\n* 2.0.9\n* 1.7.32\n\nNote: The containerd 2.1 release has reached its [end of life](https://containerd.io/releases/#current-state-of-containerd-releases) and a fixed version is not provided.\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric `runAsUser` in the Kubernetes Pod `securityContext` overrides the `USER` directive in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforce `runAsNonRoot` properly regardless of this bug.\n\n##### Credits\nThe containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### Resources\n* https://github.com/advisories/GHSA-265r-hfxg-fhmg (CVE-2024-40635)\n\n##### For ","authorHash":"97efb44525414c3936f20054d6e3e18e","rating":null,"offTopic":true},{"id":"00f2133f-8ea6-4044-8720-53cf1e5f0e91","excerpt":"Update module github.com/containerd/containerd to v1.7.36 [SECURITY] — This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](https://redir","url":"https://github.com/gardener/gardener-extension-provider-gdc/pull/22","role":"pain","weight":1.3267095,"occurredAt":"2026-10-05T16:35:57.000Z","sourceKey":"github","sourceName":"GitHub","credibility":0.78,"venue":"gardener/gardener-extension-provider-gdc","intent":"feature_request","painScore":0.77867436,"sentiment":-1,"confidence":0.74589795,"matchedPatterns":["missing_feature","workaround","product:kubernetes"],"statement":"Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and…","title":"Update module github.com/containerd/containerd to v1.7.36 [SECURITY]","body":"This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) | `v1.7.30` → `v1.7.36` |  |  |\n\n---\n\n### containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service\n[CVE-2026-53495](https://nvd.nist.gov/vuln/detail/CVE-2026-53495) / [GHSA-7jxh-36q5-gcqv](https://redirect.github.com/advisories/GHSA-7jxh-36q5-gcqv)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n##### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n##### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n##### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf there are any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 6.8 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv)\n- [https://github.com/containerd/containerd/releases/tag/v1.7.35](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.35)\n- [https://github.com/containerd/containerd/releases/tag/v2.0.12](https://redirect.github.com/containerd/containerd/releases/tag/v2.0.12)\n- [https://github.com/containerd/containerd/releases/tag/v2.2.8](https://redirect.github.com/containerd/containerd/releases/tag/v2.2.8)\n- [https://github.com/containerd/containerd/releases/tag/v2.3.5](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.5)\n- [https://github.com/advisories/GHSA-7jxh-36q5-gcqv](https://redirect.github.com/advisories/GHSA-7jxh-36q5-gcqv)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-7jxh-36q5-gcqv) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### Containerd has image-pull DoS via crafted OCI index graph amplification\n[CVE-2026-53493](https://nvd.nist.gov/vuln/detail/CVE-2026-53493) / [GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nA vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the `PullImage` operation, the recursive traversal and processing of child descriptors lack sufficient depth and breadth limits, and fail to adequately deduplicate identical descriptors. This unbounded traversal leads to excessive resource allocation.\n\nConsequently, pulling a malicious image reference can result in prolonged stalls during container creation and significant resource pressure on the host system. This issue occurs entirely during the image pull phase, prior to any container execution.\n\n##### Patches\n\nThis bug has been fixed in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36. Users should update to these versions to resolve the issue.\n\n##### Workarounds\n\nThere are no known workarounds for this issue. Users are advised to only pull trusted images from known registries until the patch can be applied.\n\n##### Credits\n\nThe containerd project would like to thank Jakub Ciolek at ElevenLabs and @jlgore who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 6.9 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-53493](https://nvd.nist.gov/vuln/detail/CVE-2026-53493)\n- [https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe](https://redirect.github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe)\n- [https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8](https://redirect.github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8)\n- [https://github.com/containerd/containerd/releases/tag/v1.7.36](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.36)\n- [https://github.com/containerd/containerd/releases/tag/v2.0.13](https://redirect.github.com/containerd/containerd/releases/tag/v2.0.13)\n- [https://github.com/containerd/containerd/releases/tag/v2.2.9](https://redirect.github.com/containerd/containerd/releases/tag/v2.2.9)\n- [https://github.com/containerd/containerd/releases/tag/v2.3.6](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.6)\n- [https://github.com/containerd/containerd/releases/tag/v2.4.1](https://redirect.github.com/containerd/containerd/releases/tag/v2.4.1)\n- [https://github.com/advisories/GHSA-pg57-6jwg-q645](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-pg57-6jwg-q645) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd user ID handling bypass allows runAsNonRoot evasion\n[CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680) / [GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where containers launched with a numeric `User` directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an `/etc/passwd` file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes `runAsNonRoot` restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.1\n* 2.2.4\n* 2.0.9\n* 1.7.32\n\nNote: The containerd 2.1 release has reached its [end of life](https://containerd.io/releases/#current-state-of-containerd-releases) and a fixed version is not provided.\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric `runAsUser` in the Kubernetes Pod `securityContext` overrides the `USER` directive in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforce `runAsNonRoot` properly regardless of this bug.\n\n##### Credits\nThe containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### Resources\n* https://github.com/advisories/GHSA-265r-hfxg-fhmg (CVE-2024-40635)\n\n##### For more information\n\nIf there are any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680)\n- [https://github.com/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd image-triggered runtime DoS via unbounded group parsing\n[CVE-2026-47262](https://nvd.nist.gov/vuln/detail/CVE-2026-47262) / [GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)\n\n\nMore information
\n\n#### Details\n##### Impact\nA vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.2\n* 2.2.5\n* 2.1.9\n* 2.0.10\n* 1.7.33\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted","authorHash":"d3aa092b0ebcd5965a29c4c1ebb939ec","rating":null,"offTopic":true},{"id":"6a1fce8a-c6d0-48d3-87fa-3e7654616158","excerpt":"chore(deps): update module github.com/containerd/containerd to v1.7.36 [security] — This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](","url":"https://github.com/MacroPower/kclipper/pull/485","role":"pain","weight":1.3009865,"occurredAt":"2026-10-05T18:29:56.000Z","sourceKey":"github","sourceName":"GitHub","credibility":0.78,"venue":"MacroPower/kclipper","intent":"feature_request","painScore":0.77867436,"sentiment":-1,"confidence":0.731436,"matchedPatterns":["missing_feature","workaround","product:kubernetes"],"statement":"Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and…","title":"chore(deps): update module github.com/containerd/containerd to v1.7.36 [security]","body":"This PR contains the following updates:\n\n| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |\n|---|---|---|---|\n| [github.com/containerd/containerd](https://redirect.github.com/containerd/containerd) | `v1.7.30` → `v1.7.36` |  |  |\n\n---\n\n> [!WARNING]\n> Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/15) for more information.\n\n---\n\n### containerd user ID handling bypass allows runAsNonRoot evasion\n[CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680) / [GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where containers launched with a numeric `User` directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an `/etc/passwd` file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes `runAsNonRoot` restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.1\n* 2.2.4\n* 2.0.9\n* 1.7.32\n\nNote: The containerd 2.1 release has reached its [end of life](https://containerd.io/releases/#current-state-of-containerd-releases) and a fixed version is not provided.\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric `runAsUser` in the Kubernetes Pod `securityContext` overrides the `USER` directive in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforce `runAsNonRoot` properly regardless of this bug.\n\n##### Credits\nThe containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### Resources\n* https://github.com/advisories/GHSA-265r-hfxg-fhmg (CVE-2024-40635)\n\n##### For more information\n\nIf there are any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 7.3 / 10 (High)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680)\n- [https://github.com/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd image-triggered runtime DoS via unbounded group parsing\n[CVE-2026-47262](https://nvd.nist.gov/vuln/detail/CVE-2026-47262) / [GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)\n\n\nMore information
\n\n#### Details\n##### Impact\nA vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.2\n* 2.2.5\n* 2.1.9\n* 2.0.10\n* 1.7.33\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used and that only trusted users have permissions to import images or schedule pods. \n\n##### Credits\n\nThe containerd project would like to thank Jakub Ciolek (@jake-ciolek) at AlphaSense and Kyle Elliott @ Trail of Bits who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 6.9 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)\n- [https://github.com/advisories/GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull\n[CVE-2026-53488](https://nvd.nist.gov/vuln/detail/CVE-2026-53488) / [GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp)\n\n\nMore information
\n\n#### Details\n##### Impact\nA bug was found in containerd where the CRI plugin propagates labels from an image config (`LABEL` instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations.\n\n##### Patches\nThis bug has been fixed in the following containerd versions:\n\n* 2.3.2\n* 2.2.5\n* 2.1.9\n* 2.0.10\n* 1.7.33\n\nUsers should update to these versions to resolve the issue.\n\n##### Workarounds\nEnsure that only trusted images are used.\n\n##### Credits\nThe containerd project would like to thank Anthropic Research, in collaboration with Claude, the GKE Security Team using Gemini, and Robert Prast (@robertprast) for independently discovering and responsibly disclosing this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Email us at [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 8.7 / 10 (High)\n- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)\n- [https://github.com/advisories/GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n \n\n---\n\n### containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service\n[CVE-2026-53495](https://nvd.nist.gov/vuln/detail/CVE-2026-53495) / [GHSA-7jxh-36q5-gcqv](https://redirect.github.com/advisories/GHSA-7jxh-36q5-gcqv)\n\n\nMore information
\n\n#### Details\n##### Impact\n\nA bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.\n\n##### Patches\n\nThis bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.\n\n##### Workarounds\n\nEnsure exec probes and lifecycle hooks do not launch long-lived background child processes.\n\n##### Credits\n\nThe containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the [containerd security policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).\n\n##### For more information\n\nIf there are any questions or comments about this advisory:\n\n* Open an issue in [containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\nTo report a security issue in containerd:\n* [Report a new vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)\n* Send an email to [security@containerd.io](mailto:security@containerd.io)\n\n#### Severity\n- CVSS Score: 6.8 / 10 (Medium)\n- Vector String: `CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`\n\n#### References\n- [https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv)\n- [https://github.com/containerd/containerd/releases/tag/v1.7.35](https://redirect.github.com/containerd/containerd/releases/tag/v1.7.35)\n- [https://github.com/containerd/containerd/releases/tag/v2.0.12](https://redirect.github.com/containerd/containerd/releases/tag/v2.0.12)\n- [https://github.com/containerd/containerd/releases/tag/v2.2.8](https://redirect.github.com/containerd/containerd/releases/tag/v2.2.8)\n- [https://github.com/containerd/containerd/releases/tag/v2.3.5](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.5)\n- [https://github.com/advisories/GHSA-7jxh-36q5-gcqv](https://redirect.github.com/advisories/GHSA-7jxh-36q5-gcqv)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories","authorHash":"e3b3256e6fb0b6d947e161e7b50f594a","rating":null,"offTopic":true}],"breakdown":[{"sourceKey":"github","sourceName":"GitHub","count":7}],"total":7}}