mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Paweł Gronowski
b665fde220
This release includes 10 security fixes covering module checksum verification, denial-of-service protections, parser crashes, XSS, and IDNA hostname validation, most notably: - CVE-2026-56865: prevent malicious GOPROXY servers from bypassing sumdb transparency-log verification: https://go.dev/issue/80744 - CVE-2026-56864: prevent malicious GOSUMDB servers from serving unauthenticated module content: https://go.dev/issue/80745 - CVE-2026-56859: add recursion limits for XML decoding: https://go.dev/issue/80481 - CVE-2026-56853: apply ReadHeaderTimeout during unencrypted HTTP/2 detection: https://go.dev/issue/80205 - CVE-2026-56860: prevent quadratic behavior in URL path resolution: https://go.dev/issue/80494 - CVE-2026-46600: prevent panics when parsing malformed SVCB/HTTPS DNS records: https://go.dev/issue/79795 - CVE-2026-56862: limit excessive TLS post-handshake messages: https://go.dev/issue/80528 - CVE-2026-56858: fix JavaScript regexp context tracking in html/template: https://go.dev/issue/80435 - CVE-2026-39821: reject invalid ASCII-only Punycode labels: https://go.dev/issue/78760 - CVE-2026-33818: add recursion limits for ASN.1 unmarshalling: https://go.dev/issue/80405 Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
VM scripts
The scripts in this directory run the containerd integration tests inside a
virtual machine (Fedora or an EL distribution, with SELinux Enforcing by
default). They are used by the integration-vm job in
.github/workflows/ci.yml, but do not depend on Lima
and can be used with other VM environments too.
Local usage with Lima
# Boot a plain VM. template:almalinux-8, -9, and -10 are tested too.
# --plain keeps the guest pristine (no guest agent, no mounts, no port forwards).
limactl start --plain --name=default --cpus=2 --memory=4 --disk=60 template:fedora-44
# Copy the source tree into the guest.
limactl cp -r . default:containerd
lima bash -c 'sudo mkdir -p /go/src/github.com/containerd && sudo mv ~/containerd /go/src/github.com/containerd/containerd'
export LIMA_WORKDIR=/go/src/github.com/containerd/containerd
# Provision the guest (packages, Go, runc, CNI plugins, cri-tools, containerd, ...).
lima sudo script/vm/provision.sh
# Run the test suites.
lima sudo script/vm/test-integration.sh
lima sudo CGROUP_DRIVER=systemd script/vm/test-cri-integration.sh
lima sudo CGROUP_DRIVER=systemd script/vm/test-cri.sh
# Clean up.
limactl delete -f default
Environment variables
provision.sh:GO_VERSION,RUNC_FLAVOR(runcorcrun),SELINUX(Enforcing,Permissive, orDisabled),INSTALL_PACKAGEStest-integration.sh:RUNC_FLAVORtest-cri-integration.sh:CGROUP_DRIVER(empty orsystemd),RUNC_FLAVORtest-cri.sh:CGROUP_DRIVER(empty orsystemd),REPORT_DIR