chore(deps): update module github.com/containerd/containerd to v1.7.35 [security] (main) - #352
Open
crossplane-renovate[bot] wants to merge 1 commit into
Open
Conversation
crossplane-renovate
Bot
requested review from
bobh66
and removed request for
a team
September 10, 2026 08:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.7.33→v1.7.35containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
CVE-2026-53495 / GHSA-7jxh-36q5-gcqv
More information
Details
Impact
A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.
Patches
This bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.
Workarounds
Ensure exec probes and lifecycle hooks do not launch long-lived background child processes.
Credits
The containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.
For more information
If there are any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.7.35: containerd 1.7.35Compare Source
Welcome to the v1.7.35 release of containerd!
The thirty-fifth patch release for containerd 1.7 contains various fixes
and updates including security patches.
Security Updates
Highlights
Image Distribution
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
13 commits
05aa78da3Prepare release notes for v1.7.353bd79bb36Merge commit from fork5a2a3a759cri: cancel ExecSync IO drain on context cancellation323e148f2Merge commit from fork9205b1903archive: skip redundant opaque whiteout walksb01d66349core/remotes/docker: normalize descriptor URL originsb5d936dcacore/remotes/docker: strip sensitive headers on desc.urls fetchcff94ea40ctr: add --scrub-logs flag for Windows544e4657dcri/config: use ScrubLogs by default on Windows71e00ba9cci: bound Go fuzzing by execution countDependency Changes
This release has no dependency changes
Previous release can be found at v1.7.34
v1.7.34: containerd 1.7.34Compare Source
Welcome to the v1.7.34 release of containerd!
The thirty-fourth patch release for containerd 1.7 contains various fixes and updates.
Highlights
Container Runtime Interface (CRI)
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
5 commits
7db112471Prepare release notes for v1.7.34c06144c85Update go to 1.26.5/1.25.12b84460e50ci: pin fog-json to resolve gem conflict2fe076ea7cri:fix lost container exit events if they arrive before info is cached862057716bump golang.org/x/* dependenciesDependency Changes
Previous release can be found at v1.7.33
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.