Skip to content

v0.0.22

Latest
Latest

Choose a tag to compare

View all tags
@pulumi-bot pulumi-bot released this 30 Jul 14:12
v0.0.22
eb787fa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode. 
Update vulnerable dependencies [SECURITY] (#805)

> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/containerd/containerd/v2](https://redirect.github.com/containerd/containerd)
| `v2.2.4` → `v2.2.5` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fcontainerd%2fcontainerd%2fv2/v2.2.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fcontainerd%2fcontainerd%2fv2/v2.2.4/v2.2.5?slim=true)
|
|
[github.com/klauspost/compress](https://redirect.github.com/klauspost/compress)
| `v1.18.6` → `v1.18.7` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fklauspost%2fcompress/v1.18.7?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fklauspost%2fcompress/v1.18.6/v1.18.7?slim=true)
|
|
[github.com/klauspost/compress](https://redirect.github.com/klauspost/compress)
| `v1.18.0` → `v1.18.7` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fklauspost%2fcompress/v1.18.7?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fklauspost%2fcompress/v1.18.0/v1.18.7?slim=true)
|
|
[github.com/regclient/regclient](https://redirect.github.com/regclient/regclient)
| `v0.7.1` → `v0.11.5` |
![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fregclient%2fregclient/v0.11.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fregclient%2fregclient/v0.7.1/v0.11.5?slim=true)
|
|
[go.opentelemetry.io/otel](https://redirect.github.com/open-telemetry/opentelemetry-go)
| `v1.43.0` → `v1.44.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel/v1.44.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel/v1.43.0/v1.44.0?slim=true)
|
| [golang.org/x/crypto](https://pkg.go.dev/golang.org/x/crypto) |
[`v0.51.0` →
`v0.52.0`](https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.51.0...refs/tags/v0.52.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fcrypto/v0.52.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fcrypto/v0.51.0/v0.52.0?slim=true)
|
| [golang.org/x/net](https://pkg.go.dev/golang.org/x/net) | [`v0.55.0` →
`v0.56.0`](https://cs.opensource.google/go/x/net/+/refs/tags/v0.55.0...refs/tags/v0.56.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fnet/v0.56.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fnet/v0.55.0/v0.56.0?slim=true)
|
| [golang.org/x/text](https://pkg.go.dev/golang.org/x/text) | [`v0.37.0`
→
`v0.39.0`](https://cs.opensource.google/go/x/text/+/refs/tags/v0.37.0...refs/tags/v0.39.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2ftext/v0.39.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2ftext/v0.37.0/v0.39.0?slim=true)
|
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
`v1.81.1` → `v1.82.1` |
![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fgrpc/v1.82.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fgrpc/v1.81.1/v1.82.1?slim=true)
|

---

### containerd image-triggered runtime DoS via unbounded group parsing
[CVE-2026-47262](https://nvd.nist.gov/vuln/detail/CVE-2026-47262) /
[GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)

<details>
<summary>More information</summary>

#### Details
##### Impact
A vulnerability in containerd allows a maliciously crafted image to
cause a Denial of Service (DoS) condition. When creating a container
from this image, memory exhaustion occurs, leading to an Out Of Memory
(OOM) kill of the containerd process. This renders the container runtime
API unavailable and can disrupt clients such as the Docker Engine or
Kubernetes control-plane components.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9
* 2.0.10
* 1.7.33

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images are used and that only trusted users
have permissions to import images or schedule pods.

##### Credits

The containerd project would like to thank Jakub Ciolek
(@&#8203;jake-ciolek) at AlphaSense and Kyle Elliott @&#8203; Trail of
Bits who independently discovered and responsibly disclosed this issue
in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 6.9 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)
-
[https://github.com/advisories/GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd: CRI checkpoint import allows local image tag poisoning
[CVE-2026-50195](https://nvd.nist.gov/vuln/detail/CVE-2026-50195) /
[GHSA-cvxm-645q-p574](https://redirect.github.com/advisories/GHSA-cvxm-645q-p574)

<details>
<summary>More information</summary>

#### Details
##### Impact
containerd's CRI checkpoint import process contains a vulnerability
where it fails to validate the image references specified within a
checkpoint image's configuration. An attacker with permissions to create
pods can use a crafted checkpoint image to force containerd to pull a
malicious image and assign it an arbitrary local tag, thereby poisoning
the node's local image cache. Subsequently, if other pods on the same
node attempt to use the poisoned tag with an `IfNotPresent` (or `Never`)
pull policy, they will unknowingly execute the attacker's malicious
image instead of the legitimate one. This can lead to a compromise of
the affected pods, allowing the attacker to execute arbitrary code under
the victim pod's identity.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9

Users should update to these versions to resolve the issue.

##### Workarounds
Users should only allow trusted images to be pulled.

##### Credits
The containerd project would like to thank Henry Beberman
(@&#8203;hbeberman) of Microsoft, the GKE Security Team using Gemini,
Anthropic Research, in collaboration with Claude, and Robert Prast
(@&#8203;robertprast) who independently discovered and responsibly
disclosed this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information
If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 5.6 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-50195](https://nvd.nist.gov/vuln/detail/CVE-2026-50195)
-
[https://github.com/advisories/GHSA-cvxm-645q-p574](https://redirect.github.com/advisories/GHSA-cvxm-645q-p574)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-cvxm-645q-p574)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI — image-config `LABEL` flows to restart-monitor
`binary://` logger: host-root command execution from an image pull
[CVE-2026-53488](https://nvd.nist.gov/vuln/detail/CVE-2026-53488) /
[GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp)

<details>
<summary>More information</summary>

#### Details
##### Impact
A bug was found in containerd where the CRI plugin propagates labels
from an image config (`LABEL` instruction in Dockerfile) to a container
without validation. This may result in executing an arbitrary command on
the host, via a plugin that consumes container labels for some
operations.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9
* 2.0.10
* 1.7.33

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images are used.

##### Credits
The containerd project would like to thank Anthropic Research, in
collaboration with Claude, the GKE Security Team using Gemini, and
Robert Prast (@&#8203;robertprast) for independently discovering and
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 8.7 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
-
[https://github.com/advisories/GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Arbitrary host CRI log file read via symlink following in CRI
checkpoint restore
[CVE-2026-53489](https://nvd.nist.gov/vuln/detail/CVE-2026-53489) /
[GHSA-rgh6-rfwx-v388](https://redirect.github.com/advisories/GHSA-rgh6-rfwx-v388)

<details>
<summary>More information</summary>

#### Details
##### Impact
A bug was found in containerd where the CRI plugin restores
`container.log` from a checkpoint image without validating a symlinked
path. This could result in reading an arbitrary file on the host via
`kubectl logs`.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images and checkpoints are used.

##### Credits
The containerd project would like to thank @&#8203;gouldnicholas and
@&#8203;davidrxchester, Yuming Zhang and Song Li of Zhejiang University,
Sangwon Ryu (@&#8203;sangwon090), Henry Beberman (@&#8203;hbeberman) of
Microsoft, the GKE Security Team using Gemini, Anthropic Research, in
collaboration with Claude, Robert Prast (@&#8203;robertprast),
Kyle Elliott (@&#8203;kyle-elliott-tob) of Trail of Bits, and Zhenchen
Wang (@&#8203;Plucky923), who independently discovered and responsibly
disclosed this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 7.1 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388)
-
[https://github.com/advisories/GHSA-rgh6-rfwx-v388](https://redirect.github.com/advisories/GHSA-rgh6-rfwx-v388)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-rgh6-rfwx-v388)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI checkpoint restore CDI annotation smuggling
[CVE-2026-53492](https://nvd.nist.gov/vuln/detail/CVE-2026-53492) /
[GHSA-33vj-92qq-66hc](https://redirect.github.com/advisories/GHSA-33vj-92qq-66hc)

<details>
<summary>More information</summary>

#### Details
##### Impact

containerd's CRI implementation improperly trusts Container Device
Interface (CDI) annotations found within untrusted checkpoint image
metadata during container restoration. When restoring a container from a
checkpoint, containerd preserves CDI-related annotations from the
checkpoint archive rather than relying solely on the pod's create-time
specification. This allows a user with pod creation permissions to
bypass standard Kubernetes resource allocation and device plugin
enforcement, injecting arbitrary CDI edits (such as device nodes and
host mounts) into the restored container. Successful exploitation
requires that the node has CDI enabled and contains a matching host CDI
specification for the requested device; environments where CDI is
disabled or lacking sensitive device specifications are not affected.

##### Patches

This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9

Users should update to these versions to resolve the issue. Recreating
existing containers restored from untrusted checkpoints may be necessary
to remove smuggled configuration.

##### Workarounds

Users can mitigate this issue by restricting the restoration of
containers from untrusted checkpoint images. If Container Device
Interface (CDI) capabilities are not utilized on the node, removing or
temporarily relocating host CDI specifications from the default
directories (`/etc/cdi` and `/var/run/cdi`) will eliminate the
reachability of this vulnerability.

##### Credits

The containerd project would like to thank Robert Prast
(@&#8203;robertprast) for responsibly disclosing this issue in
accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 8.4 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)
-
[https://github.com/advisories/GHSA-33vj-92qq-66hc](https://redirect.github.com/advisories/GHSA-33vj-92qq-66hc)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-33vj-92qq-66hc)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI checkpoint restore CDI annotation smuggling
[CVE-2026-53492](https://nvd.nist.gov/vuln/detail/CVE-2026-53492) /
[GHSA-33vj-92qq-66hc](https://redirect.github.com/advisories/GHSA-33vj-92qq-66hc)
/ [GO-2026-5064](https://pkg.go.dev/vuln/GO-2026-5064)

<details>
<summary>More information</summary>

#### Details
##### Impact

containerd's CRI implementation improperly trusts Container Device
Interface (CDI) annotations found within untrusted checkpoint image
metadata during container restoration. When restoring a container from a
checkpoint, containerd preserves CDI-related annotations from the
checkpoint archive rather than relying solely on the pod's create-time
specification. This allows a user with pod creation permissions to
bypass standard Kubernetes resource allocation and device plugin
enforcement, injecting arbitrary CDI edits (such as device nodes and
host mounts) into the restored container. Successful exploitation
requires that the node has CDI enabled and contains a matching host CDI
specification for the requested device; environments where CDI is
disabled or lacking sensitive device specifications are not affected.

##### Patches

This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9

Users should update to these versions to resolve the issue. Recreating
existing containers restored from untrusted checkpoints may be necessary
to remove smuggled configuration.

##### Workarounds

Users can mitigate this issue by restricting the restoration of
containers from untrusted checkpoint images. If Container Device
Interface (CDI) capabilities are not utilized on the node, removing or
temporarily relocating host CDI specifications from the default
directories (`/etc/cdi` and `/var/run/cdi`) will eliminate the
reachability of this vulnerability.

##### Credits

The containerd project would like to thank Robert Prast
(@&#8203;robertprast) for responsibly disclosing this issue in
accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 8.4 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-33vj-92qq-66hc) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd: CRI checkpoint import allows local image tag poisoning
[CVE-2026-50195](https://nvd.nist.gov/vuln/detail/CVE-2026-50195) /
[GHSA-cvxm-645q-p574](https://redirect.github.com/advisories/GHSA-cvxm-645q-p574)
/ [GO-2026-5338](https://pkg.go.dev/vuln/GO-2026-5338)

<details>
<summary>More information</summary>

#### Details
##### Impact
containerd's CRI checkpoint import process contains a vulnerability
where it fails to validate the image references specified within a
checkpoint image's configuration. An attacker with permissions to create
pods can use a crafted checkpoint image to force containerd to pull a
malicious image and assign it an arbitrary local tag, thereby poisoning
the node's local image cache. Subsequently, if other pods on the same
node attempt to use the poisoned tag with an `IfNotPresent` (or `Never`)
pull policy, they will unknowingly execute the attacker's malicious
image instead of the legitimate one. This can lead to a compromise of
the affected pods, allowing the attacker to execute arbitrary code under
the victim pod's identity.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9

Users should update to these versions to resolve the issue.

##### Workarounds
Users should only allow trusted images to be pulled.

##### Credits
The containerd project would like to thank Henry Beberman
(@&#8203;hbeberman) of Microsoft, the GKE Security Team using Gemini,
Anthropic Research, in collaboration with Claude, and Robert Prast
(@&#8203;robertprast) who independently discovered and responsibly
disclosed this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information
If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 5.6 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-50195](https://nvd.nist.gov/vuln/detail/CVE-2026-50195)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-cvxm-645q-p574) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd image-triggered runtime DoS via unbounded group parsing
[CVE-2026-47262](https://nvd.nist.gov/vuln/detail/CVE-2026-47262) /
[GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)
/ [GO-2026-5475](https://pkg.go.dev/vuln/GO-2026-5475)

<details>
<summary>More information</summary>

#### Details
##### Impact
A vulnerability in containerd allows a maliciously crafted image to
cause a Denial of Service (DoS) condition. When creating a container
from this image, memory exhaustion occurs, leading to an Out Of Memory
(OOM) kill of the containerd process. This renders the container runtime
API unavailable and can disrupt clients such as the Docker Engine or
Kubernetes control-plane components.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9
* 2.0.10
* 1.7.33

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images are used and that only trusted users
have permissions to import images or schedule pods.

##### Credits

The containerd project would like to thank Jakub Ciolek
(@&#8203;jake-ciolek) at AlphaSense and Kyle Elliott @&#8203; Trail of
Bits who independently discovered and responsibly disclosed this issue
in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 6.9 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-jpcc-p29g-p8mq) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Arbitrary host CRI log file read via symlink following in CRI
checkpoint restore
[CVE-2026-53489](https://nvd.nist.gov/vuln/detail/CVE-2026-53489) /
[GHSA-rgh6-rfwx-v388](https://redirect.github.com/advisories/GHSA-rgh6-rfwx-v388)
/ [GO-2026-5622](https://pkg.go.dev/vuln/GO-2026-5622)

<details>
<summary>More information</summary>

#### Details
##### Impact
A bug was found in containerd where the CRI plugin restores
`container.log` from a checkpoint image without validating a symlinked
path. This could result in reading an arbitrary file on the host via
`kubectl logs`.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images and checkpoints are used.

##### Credits
The containerd project would like to thank @&#8203;gouldnicholas and
@&#8203;davidrxchester, Yuming Zhang and Song Li of Zhejiang University,
Sangwon Ryu (@&#8203;sangwon090), Henry Beberman (@&#8203;hbeberman) of
Microsoft, the GKE Security Team using Gemini, Anthropic Research, in
collaboration with Claude, Robert Prast (@&#8203;robertprast),
Kyle Elliott (@&#8203;kyle-elliott-tob) of Trail of Bits, and Zhenchen
Wang (@&#8203;Plucky923), who independently discovered and responsibly
disclosed this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 7.1 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-rgh6-rfwx-v388) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI — image-config `LABEL` flows to restart-monitor
`binary://` logger: host-root command execution from an image pull
[CVE-2026-53488](https://nvd.nist.gov/vuln/detail/CVE-2026-53488) /
[GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp)
/ [GO-2026-5758](https://pkg.go.dev/vuln/GO-2026-5758)

<details>
<summary>More information</summary>

#### Details
##### Impact
A bug was found in containerd where the CRI plugin propagates labels
from an image config (`LABEL` instruction in Dockerfile) to a container
without validation. This may result in executing an arbitrary command on
the host, via a plugin that consumes container labels for some
operations.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.2
* 2.2.5
* 2.1.9
* 2.0.10
* 1.7.33

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images are used.

##### Credits
The containerd project would like to thank Anthropic Research, in
collaboration with Claude, the GKE Security Team using Gemini, and
Robert Prast (@&#8203;robertprast) for independently discovering and
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 8.7 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-xhf5-7wjv-pqxp) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI checkpoint restore CDI annotation smuggling in
github.com/containerd/containerd
[CVE-2026-53492](https://nvd.nist.gov/vuln/detail/CVE-2026-53492) /
[GHSA-33vj-92qq-66hc](https://redirect.github.com/advisories/GHSA-33vj-92qq-66hc)
/ [GO-2026-5064](https://pkg.go.dev/vuln/GO-2026-5064)

<details>
<summary>More information</summary>

#### Details
containerd CRI checkpoint restore CDI annotation smuggling in
github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5064) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### containerd: CRI checkpoint import allows local image tag poisoning
in github.com/containerd/containerd
[CVE-2026-50195](https://nvd.nist.gov/vuln/detail/CVE-2026-50195) /
[GHSA-cvxm-645q-p574](https://redirect.github.com/advisories/GHSA-cvxm-645q-p574)
/ [GO-2026-5338](https://pkg.go.dev/vuln/GO-2026-5338)

<details>
<summary>More information</summary>

#### Details
containerd: CRI checkpoint import allows local image tag poisoning in
github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5338) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### containerd image-triggered runtime DoS via unbounded group parsing
in github.com/containerd/containerd
[CVE-2026-47262](https://nvd.nist.gov/vuln/detail/CVE-2026-47262) /
[GHSA-jpcc-p29g-p8mq](https://redirect.github.com/advisories/GHSA-jpcc-p29g-p8mq)
/ [GO-2026-5475](https://pkg.go.dev/vuln/GO-2026-5475)

<details>
<summary>More information</summary>

#### Details
containerd image-triggered runtime DoS via unbounded group parsing in
github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5475) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Arbitrary host CRI log file read via symlink following in CRI
checkpoint restore in github.com/containerd/containerd
[CVE-2026-53489](https://nvd.nist.gov/vuln/detail/CVE-2026-53489) /
[GHSA-rgh6-rfwx-v388](https://redirect.github.com/advisories/GHSA-rgh6-rfwx-v388)
/ [GO-2026-5622](https://pkg.go.dev/vuln/GO-2026-5622)

<details>
<summary>More information</summary>

#### Details
Arbitrary host CRI log file read via symlink following in CRI checkpoint
restore in github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5622) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### containerd CRI — image-config `LABEL` flows to restart-monitor
`binary://` logger: host-root command execution from an image pull in
github.com/containerd/containerd
[CVE-2026-53488](https://nvd.nist.gov/vuln/detail/CVE-2026-53488) /
[GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/advisories/GHSA-xhf5-7wjv-pqxp)
/ [GO-2026-5758](https://pkg.go.dev/vuln/GO-2026-5758)

<details>
<summary>More information</summary>

#### Details
containerd CRI — image-config `LABEL` flows to restart-monitor
`binary://` logger: host-root command execution from an image pull in
github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5758) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### OOB read in github.com/klauspost/compress/s2

[GHSA-259r-337f-4rfw](https://redirect.github.com/advisories/GHSA-259r-337f-4rfw)
/ [GO-2026-5841](https://pkg.go.dev/vuln/GO-2026-5841)

<details>
<summary>More information</summary>

#### Details
Providing a specially crafted dictionary to s2.NewDict and using it to
encode data can make the encoder read out of bounds.

#### Severity
Unknown

#### References
-
[https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw](https://redirect.github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw)
-
[https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa](https://redirect.github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5841) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### regclient may leak authentication credentials to external blob
stores
[CVE-2026-49349](https://nvd.nist.gov/vuln/detail/CVE-2026-49349) /
[GHSA-qvqc-4c52-x6qp](https://redirect.github.com/advisories/GHSA-qvqc-4c52-x6qp)

<details>
<summary>More information</summary>

#### Details
Credentials for a registry may be inadvertently leaked to external
servers. A prerequisite for this attack is a malicious registry server,
a malicious blob store, or a registry that does not restrict the
external URLs for foreign blobs.

##### Example attack

A malicious registry serves an OCI image manifest containing a layer
descriptor with a `urls` field pointing to an attacker controlled host:

```json
{
  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
  "digest": "sha256:...",
  "size": 1024,
  "urls": ["https://malicious.example.org/blobs/sha256/..."]
}
```

When regclient fetches the image and the primary blob request to the
registry fails, it falls back to the URLs in the layer descriptor. If
the external server requests authentication, regclient would send the
credentials for the original registry server.

##### Timeline

- 2026-05-25: Advisory submitted
- 2026-05-26: Fix released

##### Credit

Theodoros Lampropoulos, Threat Detection Engineer, Odyssey Cyber
Security

#### Severity
- CVSS Score: 6.8 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N`

#### References
-
[https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp](https://redirect.github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp)
-
[https://github.com/advisories/GHSA-qvqc-4c52-x6qp](https://redirect.github.com/advisories/GHSA-qvqc-4c52-x6qp)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-qvqc-4c52-x6qp)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### regclient may leak authentication credentials to external blob
stores
[CVE-2026-49349](https://nvd.nist.gov/vuln/detail/CVE-2026-49349) /
[GHSA-qvqc-4c52-x6qp](https://redirect.github.com/advisories/GHSA-qvqc-4c52-x6qp)
/ [GO-2026-5822](https://pkg.go.dev/vuln/GO-2026-5822)

<details>
<summary>More information</summary>

#### Details
Credentials for a registry may be inadvertently leaked to external
servers. A prerequisite for this attack is a malicious registry server,
a malicious blob store, or a registry that does not restrict the
external URLs for foreign blobs.

##### Example attack

A malicious registry serves an OCI image manifest containing a layer
descriptor with a `urls` field pointing to an attacker controlled host:

```json
{
  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
  "digest": "sha256:...",
  "size": 1024,
  "urls": ["https://malicious.example.org/blobs/sha256/..."]
}
```

When regclient fetches the image and the primary blob request to the
registry fails, it falls back to the URLs in the layer descriptor. If
the external server requests authentication, regclient would send the
credentials for the original registry server.

##### Timeline

- 2026-05-25: Advisory submitted
- 2026-05-26: Fix released

##### Credit

Theodoros Lampropoulos, Threat Detection Engineer, Odyssey Cyber
Security

#### Severity
- CVSS Score: 6.8 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N`

#### References
-
[https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp](https://redirect.github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp)
-
[https://github.com/regclient/regclient](https://redirect.github.com/regclient/regclient)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-qvqc-4c52-x6qp) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### regclient may leak authentication credentials to external blob
stores in github.com/regclient/regclient
[CVE-2026-49349](https://nvd.nist.gov/vuln/detail/CVE-2026-49349) /
[GHSA-qvqc-4c52-x6qp](https://redirect.github.com/advisories/GHSA-qvqc-4c52-x6qp)
/ [GO-2026-5822](https://pkg.go.dev/vuln/GO-2026-5822)

<details>
<summary>More information</summary>

#### Details
regclient may leak authentication credentials to external blob stores in
github.com/regclient/regclient

#### Severity
Unknown

#### References
-
[https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp](https://redirect.github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5822) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Opentelemetry-go's baggage parsing no longer caps raw header length
in go.opentelemetry.io/otel
[CVE-2026-41178](https://nvd.nist.gov/vuln/detail/CVE-2026-41178) /
[GHSA-5wrp-cwcj-q835](https://redirect.github.com/advisories/GHSA-5wrp-cwcj-q835)
/ [GO-2026-5158](https://pkg.go.dev/vuln/GO-2026-5158)

<details>
<summary>More information</summary>

#### Details
Opentelemetry-go's baggage parsing no longer caps raw header length in
go.opentelemetry.io/otel

#### Severity
Unknown

#### References
-
[https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835](https://redirect.github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835)
-
[https://github.com/open-telemetry/opentelemetry-go/pull/7880](https://redirect.github.com/open-telemetry/opentelemetry-go/pull/7880)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5158) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### golang.org/x/crypto: Invoking byte arithmetic causes underflow and
panic
[CVE-2026-46597](https://nvd.nist.gov/vuln/detail/CVE-2026-46597) /
[GHSA-q4h4-gmj2-qvw2](https://redirect.github.com/advisories/GHSA-q4h4-gmj2-qvw2)

<details>
<summary>More information</summary>

#### Details
An incorrectly placed cast from bytes to int allowed for server-side
panic in the AES-GCM packet decoder for well-crafted inputs.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-46597](https://nvd.nist.gov/vuln/detail/CVE-2026-46597)
- [https://go.dev/cl/781620](https://go.dev/cl/781620)
- [https://go.dev/issue/79561](https://go.dev/issue/79561)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
-
[https://pkg.go.dev/vuln/GO-2026-5013](https://pkg.go.dev/vuln/GO-2026-5013)
-
[https://github.com/advisories/GHSA-q4h4-gmj2-qvw2](https://redirect.github.com/advisories/GHSA-q4h4-gmj2-qvw2)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-q4h4-gmj2-qvw2)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### golang.org/x/crypto vulnerable to invoking bypass of certificate
restrictions
[CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828) /
[GHSA-45gg-vh54-h5m9](https://redirect.github.com/advisories/GHSA-45gg-vh54-h5m9)

<details>
<summary>More information</summary>

#### Details
When an SSH server authentication callback returned PartialSuccessError
with non-nil Permissions, those permissions were silently discarded,
potentially dropping certificate restrictions such as force-command
after a second factor succeeded. Returning non-nil Permissions with
PartialSuccessError now results in a connection error.

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-39828](https://nvd.nist.gov/vuln/detail/CVE-2026-39828)
- [https://go.dev/cl/781621](https://go.dev/cl/781621)
- [https://go.dev/issue/79562](https://go.dev/issue/79562)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
-
[https://pkg.go.dev/vuln/GO-2026-5014](https://pkg.go.dev/vuln/GO-2026-5014)
-
[https://access.redhat.com/security/cve/CVE-2026-39828](https://access.redhat.com/security/cve/CVE-2026-39828)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2480687](https://bugzilla.redhat.com/show_bug.cgi?id=2480687)
-
[https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json)
-
[https://access.redhat.com/errata/RHSA-2026:26546](https://access.redhat.com/errata/RHSA-2026:26546)
-
[https://access.redhat.com/errata/RHSA-2026:26547](https://access.redhat.com/errata/RHSA-2026:26547)
-
[https://access.redhat.com/errata/RHSA-2026:36167](https://access.redhat.com/errata/RHSA-2026:36167)
-
[https://access.redhat.com/errata/RHSA-2026:36105](https://access.redhat.com/errata/RHSA-2026:36105)
-
[https://access.redhat.com/errata/RHSA-2026:36207](https://access.redhat.com/errata/RHSA-2026:36207)
-
[https://access.redhat.com/errata/RHSA-2026:36319](https://access.redhat.com/errata/RHSA-2026:36319)
-
[https://access.redhat.com/errata/RHSA-2026:36625](https://access.redhat.com/errata/RHSA-2026:36625)
-
[https://access.redhat.com/errata/RHSA-2026:36648](https://access.redhat.com/errata/RHSA-2026:36648)
-
[https://access.redhat.com/errata/RHSA-2026:37271](https://access.redhat.com/errata/RHSA-2026:37271)
-
[https://access.redhat.com/errata/RHSA-2026:37268](https://access.redhat.com/errata/RHSA-2026:37268)
-
[https://access.redhat.com/errata/RHSA-2026:36808](https://access.redhat.com/errata/RHSA-2026:36808)
-
[https://access.redhat.com/errata/RHSA-2026:36797](https://access.redhat.com/errata/RHSA-2026:36797)
-
[https://access.redhat.com/errata/RHSA-2026:36796](https://access.redhat.com/errata/RHSA-2026:36796)
-
[https://access.redhat.com/errata/RHSA-2026:36651](https://access.redhat.com/errata/RHSA-2026:36651)
-
[https://access.redhat.com/errata/RHSA-2026:37387](https://access.redhat.com/errata/RHSA-2026:37387)
-
[https://access.redhat.com/errata/RHSA-2026:37296](https://access.redhat.com/errata/RHSA-2026:37296)
-
[https://access.redhat.com/errata/RHSA-2026:37286](https://access.redhat.com/errata/RHSA-2026:37286)
-
[https://access.redhat.com/errata/RHSA-2026:37278](https://access.redhat.com/errata/RHSA-2026:37278)
-
[https://access.redhat.com/errata/RHSA-2026:37272](https://access.redhat.com/errata/RHSA-2026:37272)
-
[https://access.redhat.com/errata/RHSA-2026:40974](https://access.redhat.com/errata/RHSA-2026:40974)
-
[https://access.redhat.com/errata/RHSA-2026:40969](https://access.redhat.com/errata/RHSA-2026:40969)
-
[https://access.redhat.com/errata/RHSA-2026:40262](https://access.redhat.com/errata/RHSA-2026:40262)
-
[https://access.redhat.com/errata/RHSA-2026:40119](https://access.redhat.com/errata/RHSA-2026:40119)
-
[https://access.redhat.com/errata/RHSA-2026:40118](https://access.redhat.com/errata/RHSA-2026:40118)
-
[https://access.redhat.com/errata/RHSA-2026:40945](https://access.redhat.com/errata/RHSA-2026:40945)
-
[https://access.redhat.com/errata/RHSA-2026:40972](https://access.redhat.com/errata/RHSA-2026:40972)
-
[https://access.redhat.com/errata/RHSA-2026:41019](https://access.redhat.com/errata/RHSA-2026:41019)
-
[https://access.redhat.com/errata/RHSA-2026:41031](https://access.redhat.com/errata/RHSA-2026:41031)
-
[https://access.redhat.com/errata/RHSA-2026:41036](https://access.redhat.com/errata/RHSA-2026:41036)
-
[https://access.redhat.com/errata/RHSA-2026:41066](https://access.redhat.com/errata/RHSA-2026:41066)
-
[https://access.redhat.com/errata/RHSA-2026:41055](https://access.redhat.com/errata/RHSA-2026:41055)
-
[https://github.com/advisories/GHSA-45gg-vh54-h5m9](https://redirect.github.com/advisories/GHSA-45gg-vh54-h5m9)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-45gg-vh54-h5m9)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### golang.org/x/crypto is vulnerable to invoking server panic during
CheckHostKey/Authenticate flow
[CVE-2026-39835](https://nvd.nist.gov/vuln/detail/CVE-2026-39835) /
[GHSA-78mq-xcr3-xm33](https://redirect.github.com/advisories/GHSA-78mq-xcr3-xm33)

<details>
<summary>More information</summary>

#### Details
SSH servers which use CertChecker as a public key callback without
setting IsUserAuthority or IsHostAuthority could be caused to panic by a
client presenting a certificate. CertChecker now returns an error
instead of panicking when these callbacks are nil.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-39835](https://nvd.nist.gov/vuln/detail/CVE-2026-39835)
- [https://go.dev/cl/781660](https://go.dev/cl/781660)
- [https://go.dev/issue/79563](https://go.dev/issue/79563)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
-
[https://pkg.go.dev/vuln/GO-2026-5015](https://pkg.go.dev/vuln/GO-2026-5015)
-
[https://access.redhat.com/security/cve/CVE-2026-39835](https://access.redhat.com/security/cve/CVE-2026-39835)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2480680](https://bugzilla.redhat.com/show_bug.cgi?id=2480680)
-
[https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json)
-
[https://access.redhat.com/errata/RHSA-2026:26546](https://access.redhat.com/errata/RHSA-2026:26546)
-
[https://access.redhat.com/errata/RHSA-2026:26547](https://access.redhat.com/errata/RHSA-2026:26547)
-
[https://access.redhat.com/errata/RHSA-2026:36199](https://access.redhat.com/errata/RHSA-2026:36199)
-
[https://access.redhat.com/errata/RHSA-2026:36207](https://access.redhat.com/errata/RHSA-2026:36207)
-
[https://access.redhat.com/errata/RHSA-2026:36319](https://access.redhat.com/errata/RHSA-2026:36319)
-
[https://access.redhat.com/errata/RHSA-2026:36625](https://access.redhat.com/errata/RHSA-2026:36625)
-
[https://access.redhat.com/errata/RHSA-2026:36648](https://access.redhat.com/errata/RHSA-2026:36648)
-
[https://access.redhat.com/errata/RHSA-2026:37271](https://access.redhat.com/errata/RHSA-2026:37271)
-
[https://access.redhat.com/errata/RHSA-2026:37268](https://access.redhat.com/errata/RHSA-2026:37268)
-
[https://access.redhat.com/errata/RHSA-2026:37123](https://access.redhat.com/errata/RHSA-2026:37123)
-
[https://access.redhat.com/errata/RHSA-2026:37072](https://access.redhat.com/errata/RHSA-2026:37072)
-
[https://access.redhat.com/errata/RHSA-2026:36797](https://access.redhat.com/errata/RHSA-2026:36797)
-
[https://access.redhat.com/errata/RHSA-2026:36796](https://access.redhat.com/errata/RHSA-2026:36796)
-
[https://access.redhat.com/errata/RHSA-2026:36651](https://access.redhat.com/errata/RHSA-2026:36651)
-
[https://access.redhat.com/errata/RHSA-2026:37410](https://access.redhat.com/errata/RHSA-2026:37410)
-
[https://access.redhat.com/errata/RHSA-2026:37387](https://access.redhat.com/errata/RHSA-2026:37387)
-
[https://access.redhat.com/errata/RHSA-2026:37296](https://access.redhat.com/errata/RHSA-2026:37296)
-
[https://access.redhat.com/errata/RHSA-2026:37286](https://access.redhat.com/errata/RHSA-2026:37286)
-
[https://access.redhat.com/errata/RHSA-2026:37272](https://access.redhat.com/errata/RHSA-2026:37272)
-
[https://access.redhat.com/errata/RHSA-2026:38504](https://access.redhat.com/errata/RHSA-2026:38504)
-
[https://access.redhat.com/errata/RHSA-2026:40974](https://access.redhat.com/errata/RHSA-2026:40974)
-
[https://access.redhat.com/errata/RHSA-2026:40969](https://access.redhat.com/errata/RHSA-2026:40969)
-
[https://access.redhat.com/errata/RHSA-2026:40262](https://access.redhat.com/errata/RHSA-2026:40262)
-
[https://access.redhat.com/errata/RHSA-2026:40118](https://access.redhat.com/errata/RHSA-2026:40118)
-
[https://access.redhat.com/errata/RHSA-2026:40945](https://access.redhat.com/errata/RHSA-2026:40945)
-
[https://access.redhat.com/errata/RHSA-2026:40972](https://access.redhat.com/errata/RHSA-2026:40972)
-
[https://access.redhat.com/errata/RHSA-2026:41019](https://access.redhat.com/errata/RHSA-2026:41019)
-
[https://access.redhat.com/errata/RHSA-2026:41031](https://access.redhat.com/errata/RHSA-2026:41031)
-
[https://access.redhat.com/errata/RHSA-2026:41036](https://access.redhat.com/errata/RHSA-2026:41036)
-
[https://access.redhat.com/errata/RHSA-2026:41066](https://access.redhat.com/errata/RHSA-2026:41066)
-
[https://access.redhat.com/errata/RHSA-2026:42146](https://access.redhat.com/errata/RHSA-2026:42146)
-
[https://access.redhat.com/errata/RHSA-2026:42796](https://access.redhat.com/errata/RHSA-2026:42796)
-
[https://access.redhat.com/errata/RHSA-2026:43052](https://access.redhat.com/errata/RHSA-2026:43052)
-
[https://access.redhat.com/errata/RHSA-2026:43692](https://access.redhat.com/errata/RHSA-2026:43692)
-
[https://access.redhat.com/errata/RHSA-2026:46885](https://access.redhat.com/errata/RHSA-2026:46885)
-
[https://access.redhat.com/errata/RHSA-2026:47735](https://access.redhat.com/errata/RHSA-2026:47735)
-
[https://github.com/advisories/GHSA-78mq-xcr3-xm33](https://redirect.github.com/advisories/GHSA-78mq-xcr3-xm33)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-78mq-xcr3-xm33)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### golang.org/x/crypto: Invoking memory leak when rejecting channels
can lead to DoS
[CVE-2026-39827](https://nvd.nist.gov/vuln/detail/CVE-2026-39827) /
[GHSA-qpw4-5x99-6vjp](https://redirect.github.com/advisories/GHSA-qpw4-5x99-6vjp)

<details>
<summary>More information</summary>

#### Details
An authenticated SSH client that repeatedly opened channels which were
rejected by the server caused unbounded memory growth, eventually
crashing the server process and affecting all connected users. Rejected
channels are now properly removed from the connection's internal state
and released for garbage collection.

#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-39827](https://nvd.nist.gov/vuln/detail/CVE-2026-39827)
- [https://go.dev/cl/781320](https://go.dev/cl/781320)
- [https://go.dev/issue/35127](https://go.dev/issue/35127)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
-
[https://pkg.go.dev/vuln/GO-2026-5016](https://pkg.go.dev/vuln/GO-2026-5016)
-
[https://github.com/advisories/GHSA-qpw4-5x99-6vjp](https://redirect.github.com/advisories/GHSA-qpw4-5x99-6vjp)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-qpw4-5x99-6vjp)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### golang.org/x/crypto: Invoking client can cause server deadlock on
unexpected responses
[CVE-2026-39830](https://nvd.nist.gov/vuln/detail/CVE-2026-39830) /
[GHSA-vgwf-h737-ff37](https://redirect.github.com/advisories/GHSA-vgwf-h737-ff37)

<details>
<summary>More information</summary>

#### Details
A malicious SSH peer could send unsolicited global request responses to
fill an internal buffer, blocking the connection's read loop. The
blocked goroutine could not be released by calling Close(), resulting in
a resource leak per connection. Unsolicited global responses are now
discarded.

#### Severity
- CVSS Score: 9.1 / 10 (Critical)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`

#### References
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-39830](https://nvd.nist.gov/vuln/detail/CVE-2026-39830)
- [https://go.dev/cl/781640](https://go.dev/cl/781640)
- [https://go.dev/cl/781664](https://go.dev/cl/781664)
- [https://go.dev/issue/79564](https://go.dev/issue/79564)
-
[https://groups.google.com/g/golang-announce/c/a082jnz-LvI](https://groups.google.com/g/golang-announce/c/a082jnz-LvI)
-
[https://pkg.go.dev/vuln/GO-2026-5017](https://pkg.go.dev/vuln/GO-2026-5017)
-
[https://access.redhat.com/errata/RHSA-2026:29455](https://access.redhat.com/errata/RHSA-2026:29455)
-
[https://access.redhat.com/security/cve/CVE-2026-39830](https://access.redhat.com/security/cve/CVE-2026-39830)
-
[https://bugzilla.redhat.com/show_bug.cgi?id=2480684](https://bugzilla.redhat.com/show_bug.cgi?id=2480684)
-
[https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json)
-
[https://access.redhat.com/errata/RHSA-2026:35833](https://access.redhat.com/errata/RHSA-2026:35833)
- [https://ac

> ✂ **Note**
> 
> PR body was truncated to here.

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
Assets 9
Loading