Repository navigation
Update module github.com/containerd/containerd to v1.7.36 [SECURITY] (main) - #3604
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Risk Assessment: moderate (2/5) DetailsRoutine bot-driven security bump of an indirect dependency in tools/go.mod with minimal blast radius; elevated only by the dependency-file change signal and prior history of frequent churn in these files. Previous runRisk Assessment: moderate (2/5) DetailsRe-review anchoring applied: signals are substantively identical to the prior assessment — XS security dependency bump by renovate[bot] touching only tools/go.mod and tools/go.sum (2 files, 6 lines), no protected paths, well-churned files (213/196 commits, 14/11 unique authors), security label warrants moderate attention but minimal blast radius and automated provenance keep the score at 2. Previous run (2)Risk Assessment: moderate (2/5) DetailsRe-review anchoring applied: Tier 1 signals are substantively identical to the prior assessment — XS security dependency bump by renovate[bot], 1 file, 2 lines changed in tools/go.mod. Tier 2 confirms the file is extremely well-churned (339 commits) with a broad author base, indicating low systemic risk from this class of change. No linked issue; weights redistributed to Tier1=62%, Tier2=38%. The security label on an indirect containerd bump warrants moderate attention but does not elevate beyond 2 given the minimal blast radius, automated provenance, and established repo pattern for containerd updates. Score held at 2 (moderate). Previous run (3)Risk Assessment: moderate (2/5) DetailsXS security dependency bump by renovate bot against a well-churned file pair; the security label warrants moderate attention but the change is minimal, fully automated, and follows established repo patterns for containerd updates. |
|
Looks good to me Previous runLooks good to me Previous run (2)Looks good to me Previous run (3)Looks good to me |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
the
ready-for-merge
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
101b767 to
6035010
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Superseded by updated review
6035010 to
493449e
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Superseded by updated review
493449e to
356ebea
Compare
Superseded by updated review
Retro for PR #3604 — containerd security bumpOverall: Workflow succeeded cleanly. Renovate-authored, bot-reviewed, auto-merged in <24h with zero human touch. 2 files, +3/-3 (confined to Minor inefficiency observed: The review agent ran twice on the same head SHA Prior art checked — not filing duplicates:
One proposal filed below. Proposals filed
|
This PR contains the following updates:
v1.7.33→v1.7.36containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
CVE-2026-53495 / GHSA-7jxh-36q5-gcqv
More information
Details
Impact
A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.
Patches
This bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.
Workarounds
Ensure exec probes and lifecycle hooks do not launch long-lived background child processes.
Credits
The containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.
For more information
If there are any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Containerd has image-pull DoS via crafted OCI index graph amplification
CVE-2026-53493 / GHSA-pg57-6jwg-q645
More information
Details
Impact
A vulnerability exists in containerd's image pull handlers where a crafted OCI image index containing deeply nested or heavily fanned-out descriptor graphs can cause unbounded CPU and memory consumption. During the
PullImageoperation, the recursive traversal and processing of child descriptors lack sufficient depth and breadth limits, and fail to adequately deduplicate identical descriptors. This unbounded traversal leads to excessive resource allocation.Consequently, pulling a malicious image reference can result in prolonged stalls during container creation and significant resource pressure on the host system. This issue occurs entirely during the image pull phase, prior to any container execution.
Patches
This bug has been fixed in containerd 2.4.1, 2.3.6, 2.2.9, 2.0.13, and 1.7.36. Users should update to these versions to resolve the issue.
Workarounds
There are no known workarounds for this issue. Users are advised to only pull trusted images from known registries until the patch can be applied.
Credits
The containerd project would like to thank Jakub Ciolek at ElevenLabs and @jlgore who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.7.36: containerd 1.7.36Compare Source
Welcome to the v1.7.36 release of containerd!
The thirty-sixth patch release for containerd 1.7 contains various fixes
and updates including a security patch.
Security Updates
Highlights
Image Storage
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
9 commits
b0ab39c205Prepare release notes for v1.7.36670a5de22fMerge commit from forka3a39e5873Bound Walk referencesffc673f859Bound Dispatch concurrency and references19334a4d7epkg/oci: mask thermal interrupt info4684c683c2core/unpack: fetch layers of every config-sharing manifest7fba9f7c3cCreate new imagetest packageDependency Changes
This release has no dependency changes
Previous release can be found at v1.7.35
v1.7.35: containerd 1.7.35Compare Source
Welcome to the v1.7.35 release of containerd!
The thirty-fifth patch release for containerd 1.7 contains various fixes
and updates including security patches.
Security Updates
Highlights
Image Distribution
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
13 commits
05aa78da3Prepare release notes for v1.7.353bd79bb36Merge commit from fork5a2a3a759cri: cancel ExecSync IO drain on context cancellation323e148f2Merge commit from fork9205b1903archive: skip redundant opaque whiteout walksb01d66349core/remotes/docker: normalize descriptor URL originsb5d936dcacore/remotes/docker: strip sensitive headers on desc.urls fetchcff94ea40ctr: add --scrub-logs flag for Windows544e4657dcri/config: use ScrubLogs by default on Windows71e00ba9cci: bound Go fuzzing by execution countDependency Changes
This release has no dependency changes
Previous release can be found at v1.7.34
v1.7.34: containerd 1.7.34Compare Source
Welcome to the v1.7.34 release of containerd!
The thirty-fourth patch release for containerd 1.7 contains various fixes and updates.
Highlights
Container Runtime Interface (CRI)
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
5 commits
7db112471Prepare release notes for v1.7.34c06144c85Update go to 1.26.5/1.25.12b84460e50ci: pin fog-json to resolve gem conflict2fe076ea7cri:fix lost container exit events if they arrive before info is cached862057716bump golang.org/x/* dependenciesDependency Changes
Previous release can be found at v1.7.33
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.