fix(security/UNKNOWN/): Update module github.com/containerd/containerd/v2 to v2.0.10 [SECURITY] (release-3.7.x) by renovate-sh-app[bot] · Pull Request #22478 · grafana/loki

renovate-sh-app · 2026-06-19T23:05:58Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containerd/containerd/v2	`v2.0.9` → `v2.0.10`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

containerd image-triggered runtime DoS via unbounded group parsing

CVE-2026-47262 / GHSA-jpcc-p29g-p8mq / GO-2026-5475

More information

Details

Impact

A vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components.

Patches

This bug has been fixed in the following containerd versions:

2.3.2
2.2.5
2.1.9
2.0.10
1.7.33

Users should update to these versions to resolve the issue.

Workarounds

Ensure that only trusted images are used and that only trusted users have permissions to import images or schedule pods.

Credits

The containerd project would like to thank Jakub Ciolek (@jake-ciolek) at AlphaSense and Kyle Elliott @ Trail of Bits who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

Open an issue in containerd
Email us at security@containerd.io

To report a security issue in containerd:

Report a new vulnerability
Email us at security@containerd.io

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

CVE-2026-53488 / GHSA-xhf5-7wjv-pqxp / GO-2026-5758

More information

Details

Impact

A bug was found in containerd where the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations.

Patches

This bug has been fixed in the following containerd versions:

2.3.2
2.2.5
2.1.9
2.0.10
1.7.33

Users should update to these versions to resolve the issue.

Workarounds

Ensure that only trusted images are used.

Credits

The containerd project would like to thank Anthropic Research, in collaboration with Claude, the GKE Security Team using Gemini, and Robert Prast (@robertprast) for independently discovering and responsibly disclosing this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

Open an issue in containerd
Email us at security@containerd.io

To report a security issue in containerd:

Report a new vulnerability
Email us at security@containerd.io

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd

CVE-2026-47262 / GHSA-jpcc-p29g-p8mq / GO-2026-5475

More information

Details

containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd

Severity

Unknown

References

https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd

CVE-2026-53488 / GHSA-xhf5-7wjv-pqxp / GO-2026-5758

More information

Details

containerd CRI — image-config LABEL flows to restart-monitor binary:// logger: host-root command execution from an image pull in github.com/containerd/containerd

Severity

Unknown

References

https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

containerd/containerd (github.com/containerd/containerd/v2)

`v2.0.10`: containerd 2.0.10

Compare Source

Welcome to the v2.0.10 release of containerd!

The tenth patch release for containerd 2.0 includes various bug fixes and updates including security patches.

Security Updates

containerd
- CVE-2026-53488
- CVE-2026-47262

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Samuel Karp
Chris Henzie
Akhil Mohan
Akihiro Suda
Ben Cressey
Davanum Srinivas
Paweł Gronowski
Sebastiaan van Stijn

Changes

17 commits

Prepare release notes for v2.0.10 (#13630)
- cbbd21672 Prepare release notes for v2.0.10
- 200a4005f Merge commit from fork
- da4098647 Merge commit from fork
- 03a19324f Bound user-database file reads in openBoundedUserFile
- 126177ea4 Merge commit from fork
- bbf4a2b8e Do not propagate reserved labels from image configs
update runc binary to v1.3.6 (#13619)
- a15e98122 update runc binary to v1.3.6
- ba2ed2a5e [release/2.2] update runc binary to v1.3.5
- 474184497 runc: Update runc binary to v1.3.4
update go to 1.26.4/1.25.11 (#13581)
- becbb802e update go to 1.26.4/1.25.11
Configure udevd children-max for root-test (#13565)
- 55bdc8bc5 Configure udevd children-max for root-test
Clean up disk space in node e2e workflow (#13553)
- 6d81e8867 Clean up disk space in node e2e workflow

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.9

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

…d/v2 to v2.0.10 [SECURITY] | datasource | package | from | to | | ---------- | ----------------------------------- | ------ | ------- | | go | github.com/containerd/containerd/v2 | v2.0.9 | v2.0.10 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>

github-actions · 2026-06-29T14:32:41Z

⚠️ The workflow jobs listed below don't declare a permissions: block and may break when the organization's default GITHUB_TOKEN permissions are restricted to read-only.

Expand for findings

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/helm-ci.yml:2:1
    |
  2 | / name: helm-ci
  3 | | on:
  4 | |   pull_request:
  5 | |     paths:
...   |
220 | |           DEBUG: ${{ runner.debug == '1' && 'true' || 'false' }}
221 | |           VERBOSE: ${{ runner.debug == '1' && 'true' || 'false' }}
    | |___________________________________________________________________^ default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/helm-ci.yml:93:3
    |
 93 | /   list-integration-tests:
 94 | |     name: List integration tests
 95 | |     runs-on: ubuntu-latest
 96 | |     outputs:
...   |
111 | |           echo "Tests: ${tests}"
112 | |           echo "tests=$(echo "${tests}" | jq --raw-input --slurp --compact-output 'split("\n") | map(select(. != ""))')" >> "${GITHUB_OUTPUT}"
    | |                                                                                                                                              ^
    | |                                                                                                                                              |
    | |______________________________________________________________________________________________________________________________________________this job
    |                                                                                                                                                default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
   --> ./.github/workflows/helm-ci.yml:114:3
    |
114 | /   run-integration-tests:
115 | |     name: Integration Test
116 | |     needs: list-integration-tests
117 | |     runs-on: ubuntu-latest
...   |
220 | |           DEBUG: ${{ runner.debug == '1' && 'true' || 'false' }}
221 | |           VERBOSE: ${{ runner.debug == '1' && 'true' || 'false' }}
    | |                                                                   ^
    | |                                                                   |
    | |___________________________________________________________________this job
    |                                                                     default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium
    = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:1:1
   |
 1 | / name: operator images
 2 | |
 3 | | on:
 4 | |   push:
...  |
45 | |       image_name: "storage-size-calculator"
46 | |       tag: "latest"
   | |____________________^ default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:12:3
   |
12 | /   publish-grafana-operator:
13 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
14 | |     with:
15 | |       dockerfile: "operator/Dockerfile"
...  |
18 | |       image_name: "loki-operator"
19 | |       tag: "latest"
   | |                   ^
   | |                   |
   | |___________________this job
   |                     default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:21:3
   |
21 | /   publish-openshift-operator:
22 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
23 | |     with:
24 | |       dockerfile: "operator/Dockerfile"
...  |
27 | |       image_name: "loki-operator"
28 | |       tag: "latest"
   | |                   ^
   | |                   |
   | |___________________this job
   |                     default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:30:3
   |
30 | /   publish-openshift-bundle:
31 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
32 | |     with:
33 | |       dockerfile: "operator/bundle/openshift/bundle.Dockerfile"
...  |
36 | |       image_name: "loki-operator-bundle"
37 | |       tag: "latest"
   | |                   ^
   | |                   |
   | |___________________this job
   |                     default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/operator-images.yaml:39:3
   |
39 | /   publish-openshift-size-calculator:
40 | |     uses: ./.github/workflows/operator-reusable-image-build.yml
41 | |     with:
42 | |       dockerfile: "operator/calculator.Dockerfile"
...  |
45 | |       image_name: "storage-size-calculator"
46 | |       tag: "latest"
   | |                    ^
   | |                    |
   | |____________________this job
   |                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

renovate-sh-app Bot requested a review from a team as a code owner June 19, 2026 23:05

renovate-sh-app Bot added automerge-security-update severity:HIGH update-patch labels Jun 19, 2026

This comment has been minimized.

Sign in to view

renovate-sh-app Bot force-pushed the deps-update/release-3.7.x-security-github.comcontainerdcontainerdv2 branch from 854806e to 0136b4e Compare June 22, 2026 14:10

renovate-sh-app Bot added update-minor and removed update-patch labels Jun 22, 2026

renovate-sh-app Bot changed the title ~~fix(security/HIGH/): Update security github.com/containerd/containerd/v2 to v2.0.10 [SECURITY] (release-3.7.x)~~ Jun 22, 2026

This comment has been minimized.

Sign in to view

renovate-sh-app Bot added severity:UNKNOWN and removed severity:HIGH labels Jun 26, 2026

renovate-sh-app Bot changed the title ~~fix(security/HIGH/): Update security github.com/containerd/containerd/v2 to v2.2.5 [SECURITY] (release-3.7.x)~~ Jun 26, 2026

renovate-sh-app Bot changed the title ~~fix(security/UNKNOWN/): Update security github.com/containerd/containerd/v2 to v2.2.5 [SECURITY] (release-3.7.x)~~ Jun 29, 2026

renovate-sh-app Bot force-pushed the deps-update/release-3.7.x-security-github.comcontainerdcontainerdv2 branch from 0136b4e to c76f052 Compare June 29, 2026 14:31

renovate-sh-app Bot added update-patch and removed update-minor labels Jun 29, 2026

renovate-sh-app Bot changed the title ~~fix(security/UNKNOWN/): Update module github.com/containerd/containerd/v2 to v2.2.5 [SECURITY] (release-3.7.x)~~ Jun 29, 2026

rfratto approved these changes Jun 29, 2026

View reviewed changes

rfratto merged commit 6fa6165 into release-3.7.x Jun 29, 2026
85 checks passed

rfratto deleted the deps-update/release-3.7.x-security-github.comcontainerdcontainerdv2 branch June 29, 2026 19:28

loki-gh-app Bot mentioned this pull request Jun 29, 2026

chore(release-3.7.x): Release 3.7.4 #22778

Merged

loki-gh-app Bot mentioned this pull request Jul 22, 2026

chore(release-3.7.x): Release 3.7.5 #23400

Open

BrewTestBot mentioned this pull request Jul 24, 2026

logcli loki 3.7.4 Homebrew/homebrew-core#294969

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(security/UNKNOWN/): Update module github.com/containerd/containerd/v2 to v2.0.10 [SECURITY] (release-3.7.x) - #22478

fix(security/UNKNOWN/): Update module github.com/containerd/containerd/v2 to v2.0.10 [SECURITY] (release-3.7.x)#22478
rfratto merged 1 commit into
release-3.7.xfrom
deps-update/release-3.7.x-security-github.comcontainerdcontainerdv2

renovate-sh-app Bot commented Jun 19, 2026 •

edited

Loading

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Jun 29, 2026

Uh oh!

Labels

1 participant

Uh oh!

Conversation

renovate-sh-app Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

containerd image-triggered runtime DoS via unbounded group parsing

Details

Impact

Patches

Workarounds

Credits

For more information

Severity

References

containerd CRI — image-config LABEL flows to restart-monitor binary:// logger: host-root command execution from an image pull

Details

Impact

Patches

Workarounds

Credits

For more information

Severity

References

containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd

Details

Severity

References

containerd CRI — image-config LABEL flows to restart-monitor binary:// logger: host-root command execution from an image pull in github.com/containerd/containerd

Details

Severity

References

Release Notes

v2.0.10: containerd 2.0.10

Security Updates

Contributors

Changes

Dependency Changes

Which file should I download?

Configuration

Need help?

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented Jun 29, 2026

Uh oh!

Labels

1 participant

renovate-sh-app Bot commented Jun 19, 2026 •

edited

Loading

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd

`v2.0.10`: containerd 2.0.10