This update for containerd fixes the following issues:
- CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP
response body reading (bsc#1274214).
- CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
- CVE-2026-53493: a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container
start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability (bsc#1282669).
- CVE-2026-53495: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280007).
- CVE-2026-9
This update for containerd fixes the following issues:
- CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation (bsc#1268430).
This update for containerd fixes the following issues:
- CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial of service
(bsc#1262266).
This update for containerd fixes the following issues
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260296).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265794).
- CVE-2026-34986: github.com/go-jose/go-jose/v3: crafted JWE input with a missing encrypted key can lead to a denial of
service (bsc#1262948).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266640).
This update for containerd fixes the following issues:
- Update to containerd v1.7.29
- CVE-2024-25621: Fixed an overly broad default permission vulnerability. (bsc#1253126)
- CVE-2025-64329: Fixed a goroutine leaks which can lead to memory exhaustion on the host. (bsc#1253132)
This update for containerd fixes the following issues:
- CVE-2024-40635: Fixed integer overflow in User ID handling (bsc#1239749)
Other fixes:
- Update to containerd v1.7.27.