mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Paweł Gronowski
b665fde220
This release includes 10 security fixes covering module checksum verification, denial-of-service protections, parser crashes, XSS, and IDNA hostname validation, most notably: - CVE-2026-56865: prevent malicious GOPROXY servers from bypassing sumdb transparency-log verification: https://go.dev/issue/80744 - CVE-2026-56864: prevent malicious GOSUMDB servers from serving unauthenticated module content: https://go.dev/issue/80745 - CVE-2026-56859: add recursion limits for XML decoding: https://go.dev/issue/80481 - CVE-2026-56853: apply ReadHeaderTimeout during unencrypted HTTP/2 detection: https://go.dev/issue/80205 - CVE-2026-56860: prevent quadratic behavior in URL path resolution: https://go.dev/issue/80494 - CVE-2026-46600: prevent panics when parsing malformed SVCB/HTTPS DNS records: https://go.dev/issue/79795 - CVE-2026-56862: limit excessive TLS post-handshake messages: https://go.dev/issue/80528 - CVE-2026-56858: fix JavaScript regexp context tracking in html/template: https://go.dev/issue/80435 - CVE-2026-39821: reject invalid ASCII-only Punycode labels: https://go.dev/issue/78760 - CVE-2026-33818: add recursion limits for ASN.1 unmarshalling: https://go.dev/issue/80405 Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>