mirror of
https://github.com/containerd/containerd.git
synced 2026-11-06 05:17:02 +00:00
Paweł Gronowski
b665fde220
This release includes 10 security fixes covering module checksum verification, denial-of-service protections, parser crashes, XSS, and IDNA hostname validation, most notably: - CVE-2026-56865: prevent malicious GOPROXY servers from bypassing sumdb transparency-log verification: https://go.dev/issue/80744 - CVE-2026-56864: prevent malicious GOSUMDB servers from serving unauthenticated module content: https://go.dev/issue/80745 - CVE-2026-56859: add recursion limits for XML decoding: https://go.dev/issue/80481 - CVE-2026-56853: apply ReadHeaderTimeout during unencrypted HTTP/2 detection: https://go.dev/issue/80205 - CVE-2026-56860: prevent quadratic behavior in URL path resolution: https://go.dev/issue/80494 - CVE-2026-46600: prevent panics when parsing malformed SVCB/HTTPS DNS records: https://go.dev/issue/79795 - CVE-2026-56862: limit excessive TLS post-handshake messages: https://go.dev/issue/80528 - CVE-2026-56858: fix JavaScript regexp context tracking in html/template: https://go.dev/issue/80435 - CVE-2026-39821: reject invalid ASCII-only Punycode labels: https://go.dev/issue/78760 - CVE-2026-33818: add recursion limits for ASN.1 unmarshalling: https://go.dev/issue/80405 Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
contrib
The contrib directory contains packages that do not belong in the core containerd packages but still contribute to overall containerd usability.
Package such as Apparmor or Selinux are placed in contrib because they are platform dependent and often require higher level tools and profiles to work.
Packaging and other built tools can be added to contrib to aid in packaging containerd for various distributions.
Testing
Code in the contrib directory may or may not have been tested in the normal test pipeline for core components.