chore(deps): update module github.com/containerd/containerd/v2 to v2.0.5 [security] (release-3.5.x) #17796
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
area/security
dependencies
renovate
bot
changed the title
renovate
bot
deleted the
deps-update/release-3.5.x-go-github.com-containerd-containerd-v2-vulnerability
branch
renovate
bot
changed the title
renovate
bot
force-pushed
the
deps-update/release-3.5.x-go-github.com-containerd-containerd-v2-vulnerability
branch
from
6195790 to
3270536
Compare
paul1r
approved these changes
May 29, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.0.4->v2.0.5GitHub Vulnerability Alerts
CVE-2025-47291
Impact
A bug was found in the containerd's CRI implementation where containerd doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node.
Patches
This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue.
Workarounds
Disable usernamespaced pods in Kubernetes temporarily.
Credits
The containerd project would like to thank Rodrigo Campos Catelin and Piotr Rogowski for responsibly disclosing this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd
CVE-2025-47291 / GHSA-cxfp-7pvr-95ff / GO-2025-3701
More information
Details
Incorrect cgroup assignment for containers running in usernamespaced Kubernetes pods in github.com/containerd/containerd
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
CVE-2025-47291 / GHSA-cxfp-7pvr-95ff / GO-2025-3701
More information
Details
Impact
A bug was found in the containerd's CRI implementation where containerd doesn't put usernamespaced containers under the Kubernetes' cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node.
Patches
This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue.
Workarounds
Disable usernamespaced pods in Kubernetes temporarily.
Credits
The containerd project would like to thank Rodrigo Campos Catelin and Piotr Rogowski for responsibly disclosing this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd/v2)
v2.0.5: containerd 2.0.5Compare Source
Welcome to the v2.0.5 release of containerd!
The fifth patch release for containerd 2.0 includes various bug fixes and updates.
Highlights
Build and Release Toolchain
Container Runtime Interface (CRI)
Image Distribution
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
33 commits
5bcf0a95euse go1.23.8 as the default go version4838f33f7update to go 1.24.2, 1.23.8a8082cd60Prepare release notes for v2.0.558b715ad8Disable arm64 criu testing in GH Actionsb4a53e826disable portmap test in ubuntu-22 to make CI happy4bcf472deadd option to skip tests in critest8a638b71aPrevent panic in Docker pusher.84d9658c3Set default differ for the default unpack config of transfer serviceb184a97d3ci: update GitHub Actions release runner to ubuntu-24.04e04543db0use shimCtx for fifo copy9f46e7a44integration/client: add tests for TaskOptions is not empty8a16a6a04prefer task options for PluginInfo requesta183b2d23update taskOptions based on runtimeOptions when creating a task091143135*: CRIImageService should delete image synchronouslyc2372c072Update runc binary to v1.2.6e8506511bgo.{mod,sum}: bump CDI deps to stable v1.0.0.4cfb89430go.mod: github.com/go-jose/go-jose/v42b9e6a29dgo.mod: golang.org/x/oauth2 v0.28.06df1ea0d9go.mod: golang.org/x/net v0.37.016f20abdfFix CI lint errorDependency Changes
Previous release can be found at v2.0.4
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.