[release/2.2] update to Go 1.25.9, 1.26.2 by thaJeztah · Pull Request #13190 · containerd/containerd

thaJeztah · 2026-04-08T20:52:36Z

go1.25.9 (released 2026-04-07) includes security fixes to the go command, the compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os packages, as well as bug fixes to the go command, the compiler, and the runtime. See the Go 1.25.9 milestone on our issue tracker for details.

From the security announce:

We have just released Go versions 1.26.2 and 1.25.9, minor point releases.

These releases include 10 security fixes following the security policy:

os: Root.Chmod can follow symlinks out of the root on Linux

On Linux, if the target of Root.Chmod is replaced with a symlink while
the chmod operation is in progress, Chmod could operate on the target
of the symlink, even when the target lies outside the root.

The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag,
which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its
target before acting and returns an error if the target is a symlink
lying outside the root, so the impact is limited to cases where the
target is replaced with a symlink between the check and operation.

On Linux, Root.Chmod now uses the fchmodat2 syscall when available, and
an workaround using /proc/self/fd otherwise.

Thanks to Uuganbayar Lkhamsuren for reporting this issue.

This is CVE-2026-32282 and Go issue https://go.dev/issue/78293.
html/template: JS template literal context incorrectly tracked

Context was not properly tracked across template branches for JS template
literals, leading to possibly incorrect escaping of content when branches were
used.

Additionally template actions within JS template literals did not properly
track
the brace depth, leading to incorrect escaping being applied.

These issues could cause actions within JS template literals to be incorrectly
or improperly escaped, leading to XSS vulnerabilities.

This only affects templates that use template actions within JS template
literals.

This is CVE-2026-32289 and Go issue https://go.dev/issue/78331.
crypto/x509: excluded DNS constraints not properly applied to wildcard domains

When verifying a certificate chain containing excluded DNS constraints, these
constraints are not correctly applied to wildcard DNS SANs which use a
different
case than the constraint.

For example, if a certificate contains the DNS name "*.example.com" and the
excluded DNS name "EXAMPLE.COM", the constraint will not be applied.

This only affects validation of otherwise trusted certificate chains, issued
by
a root CA in the VerifyOptions.Roots CertPool, or in the system certificate
pool.

This issue only affects Go 1.26.

Thank you to Riyas from Saintgits College of Engineering, k1rnt, @1seal for
reporting this issue.

This is CVE-2026-33810 and Go issue https://go.dev/issue/78332.
cmd/compile: no-op interface conversion bypasses overlap checking

Previously, the compiler failed to unwrap pointers contained within
a no-op interface conversion leading to an incorrect determination
of a non-overlapping move.

To prevent unsafe move operations, the compiler will now unwrap all
such conversions before considering a move non-overlapping.

Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

This is CVE-2026-27144 and Go issue https://go.dev/issue/78371.
cmd/compile: possible memory corruption after bound check elimination

Previously, slices and arrays accessed using induction variables
were sometimes incorrectly proved in-bound. If the induction variable
used for indexing were to overflow or underflow, it could allow access
to memory beyond the scope of the original slice or array.

To prevent this behavior, the compiler ensures that any mutated induction
variable that overflows/underflows with respect to its loop condition
is not used for bound check elimination.

Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

This is CVE-2026-27143 and Go issue https://go.dev/issue/78333.
archive/tar: unbounded allocation when parsing old format GNU sparse map

tar.Reader could allocate an unbounded amount of memory when reading
a maliciously-crafted archive containing a large number of sparse
regions encoded in the "old GNU sparse map" format.

We now limit both the number of old GNU sparse map extension blocks,
and the total number of sparse file entries, regardless of encoding.

Thanks to Colin Walters ([email protected]) who initially reported this issue.
Thanks also to Uuganbayar Lkhamsuren (https://github.com/uug4na) and Jakub
Ciolek
who additionally reported this issue.

This is CVE-2026-32288 and Go issue https://go.dev/issue/78301.
crypto/tls: multiple key update handshake messages can cause connection to deadlock

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.

This only affects TLS 1.3.

Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

This is CVE-2026-32283 and Go issue https://go.dev/issue/78334.
cmd/go: trust layer bypass when using cgo and SWIG

A well-crafted SWIG source file could take advantage of a file-naming convention used inside the trust boundary of the cgo compiler. Doing so could result in arbitrary code execution during build time.

SWIG files are disallowed from using this convention.

Thank you to Juho Forsén of Mattermost for reporting this issue.

This is CVE-2026-27140 and Go issue https://go.dev/issue/78335.
crypto/x509: unexpected work during chain building

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

This is CVE-2026-32280 and Go issue https://go.dev/issue/78282.
crypto/x509: inefficient policy validation

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.

This is CVE-2026-32281 and Go issue https://go.dev/issue/78281.

@1seal

go1.25.9 (released 2026-04-07) includes security fixes to the go command, the compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os packages, as well as bug fixes to the go command, the compiler, and the runtime. See the Go 1.25.9 milestone on our issue tracker for details. - https://github.com/golang/go/issues?q=milestone%3AGo1.25.9+label%3ACherryPickApproved - full diff: golang/go@go1.25.8...go1.25.9 From the security announce: We have just released Go versions 1.26.2 and 1.25.9, minor point releases. These releases include 10 security fixes following the security policy: - os: Root.Chmod can follow symlinks out of the root on Linux On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod could operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation. On Linux, Root.Chmod now uses the fchmodat2 syscall when available, and an workaround using /proc/self/fd otherwise. Thanks to Uuganbayar Lkhamsuren for reporting this issue. This is CVE-2026-32282 and Go issue https://go.dev/issue/78293. - html/template: JS template literal context incorrectly tracked Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities. This only affects templates that use template actions within JS template literals. This is CVE-2026-32289 and Go issue https://go.dev/issue/78331. - crypto/x509: excluded DNS constraints not properly applied to wildcard domains When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. For example, if a certificate contains the DNS name "*.example.com" and the excluded DNS name "EXAMPLE.COM", the constraint will not be applied. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. This issue only affects Go 1.26. Thank you to Riyas from Saintgits College of Engineering, k1rnt, @1seal for reporting this issue. This is CVE-2026-33810 and Go issue https://go.dev/issue/78332. - cmd/compile: no-op interface conversion bypasses overlap checking Previously, the compiler failed to unwrap pointers contained within a no-op interface conversion leading to an incorrect determination of a non-overlapping move. To prevent unsafe move operations, the compiler will now unwrap all such conversions before considering a move non-overlapping. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-27144 and Go issue https://go.dev/issue/78371. - cmd/compile: possible memory corruption after bound check elimination Previously, slices and arrays accessed using induction variables were sometimes incorrectly proved in-bound. If the induction variable used for indexing were to overflow or underflow, it could allow access to memory beyond the scope of the original slice or array. To prevent this behavior, the compiler ensures that any mutated induction variable that overflows/underflows with respect to its loop condition is not used for bound check elimination. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-27143 and Go issue https://go.dev/issue/78333. - archive/tar: unbounded allocation when parsing old format GNU sparse map tar.Reader could allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format. We now limit both the number of old GNU sparse map extension blocks, and the total number of sparse file entries, regardless of encoding. Thanks to Colin Walters ([email protected]) who initially reported this issue. Thanks also to Uuganbayar Lkhamsuren (https://github.com/uug4na) and Jakub Ciolek who additionally reported this issue. This is CVE-2026-32288 and Go issue https://go.dev/issue/78301. - crypto/tls: multiple key update handshake messages can cause connection to deadlock If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-32283 and Go issue https://go.dev/issue/78334. - cmd/go: trust layer bypass when using cgo and SWIG A well-crafted SWIG source file could take advantage of a file-naming convention used inside the trust boundary of the cgo compiler. Doing so could result in arbitrary code execution during build time. SWIG files are disallowed from using this convention. Thank you to Juho Forsén of Mattermost for reporting this issue. This is CVE-2026-27140 and Go issue https://go.dev/issue/78335. - crypto/x509: unexpected work during chain building During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-32280 and Go issue https://go.dev/issue/78282. - crypto/x509: inefficient policy validation Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue. This is CVE-2026-32281 and Go issue https://go.dev/issue/78281. Signed-off-by: Sebastiaan van Stijn <[email protected]>

Upgrade the default Go version to 1.25.9 and update CI matrix to ["1.25.9", "1.26.2"]. Go 1.24 is out of support, and these releases include important security fixes. Mirrors changes in PR containerd#13190 (release/2.2) and containerd#13189 (release/2.1). Assisted-by: Antigravity Signed-off-by: Chris Henzie <[email protected]>

samuelkarp · 2026-04-08T21:43:41Z

/retest

Upgrade the default Go version to 1.25.9 and update CI matrix to ["1.25.9", "1.26.2"]. Go 1.24 is out of support, and these releases include important security fixes. Mirrors changes in PR containerd#13190 (release/2.2) and containerd#13189 (release/2.1). Assisted-by: Antigravity Signed-off-by: Chris Henzie <[email protected]>

containerd 2.2.3 Welcome to the v2.2.3 release of containerd! The third patch release for containerd 2.2 contains various fixes and updates including a security patch. * **spdystream** * [**CVE-2026-35469**](GHSA-pc3f-x583-g7j2) * Preserve cgroup mount options for privileged containers ([containerd#13120](containerd#13120)) * Ensure UpdatePodSandbox returns Unimplemented instead of a generic error ([containerd#13023](containerd#13023)) * Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 ([containerd#13015](containerd#13015)) * Enable mount manager in diff walking to fix layer extraction errors with some snapshotters (e.g., EROFS) ([containerd#13198](containerd#13198)) * Apply hardening to prevent TOCTOU race during tar extraction ([containerd#12971](containerd#12971)) * Restore support for client-mounted roots in Windows containers using process isolation ([containerd#13195](containerd#13195)) * Update runc to v1.3.5 ([containerd#13061](containerd#13061)) * Apply absolute symlink resolution to /etc/group in OCI spec to fix lookups on NixOS-style systems ([containerd#13019](containerd#13019)) * Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 ([containerd#13015](containerd#13015)) * Fix bug that caused whiteouts to be ignored when parallel unpack was used ([containerd#13125](containerd#13125)) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues. * Samuel Karp * Sebastiaan van Stijn * Maksym Pavlenko * Chris Henzie * Derek McGowan * Paulo Oliveira * Henry Wang * Phil Estes * Wei Fu * Akihiro Suda * Gao Xiang * Ricardo Branco * Shachar Tal <details><summary>40 commits</summary> <p> * Prepare release notes for v2.2.3 ([containerd#13224](containerd#13224)) * [`8a0f4ed5d`](containerd@8a0f4ed) Prepare release notes for v2.2.3 * update github.com/moby/spdystream v0.5.1 ([containerd#13217](containerd#13217)) * [`31bd34a06`](containerd@31bd34a) update github.com/moby/spdystream v0.5.1 * vendor: github.com/klauspost/compress v1.18.5 ([containerd#13197](containerd#13197)) * [`1336f6c45`](containerd@1336f6c) vendor: github.com/klauspost/compress v1.18.5 * diff/walking: enable mount manager ([containerd#13198](containerd#13198)) * [`409f75be8`](containerd@409f75b) diff/walking: enable mount manager * update runhcs to v0.14.1 ([containerd#13195](containerd#13195)) * [`3f33146c1`](containerd@3f33146) update runhcs to v0.14.1 * vendor: github.com/Microsoft/hcsshim v0.14.1 ([containerd#13196](containerd#13196)) * [`8bd1b74e5`](containerd@8bd1b74) vendor: github.com/Microsoft/hcsshim v0.14.1 * [`c6b0be8e1`](containerd@c6b0be8) vendor: github.com/Microsoft/hcsshim v0.14.0 * update to Go 1.25.9, 1.26.2 ([containerd#13190](containerd#13190)) * [`2ecde8cfe`](containerd@2ecde8c) update to Go 1.25.9, 1.26.2 * Skip TestExportAndImportMultiLayer on s390x ([containerd#13154](containerd#13154)) * [`be554f478`](containerd@be554f4) Skip TestExportAndImportMultiLayer on s390x * Tweak mount info for overlayfs in case of parallel unpack ([containerd#13125](containerd#13125)) * [`660de195b`](containerd@660de19) Tweak mount info for overlayfs in case of parallel unpack * [`bc9274a4b`](containerd@bc9274a) Add integration test for issue 13030 * Preserve cgroup mount options for privileged containers ([containerd#13120](containerd#13120)) * [`c387890b5`](containerd@c387890) Add integration test for privileged container cgroup mounts * [`047a335a6`](containerd@047a335) Forward RUNC_FLAVOR env var down to integration tests * [`9b2d72ee0`](containerd@9b2d72e) Preserve host cgroup mount options for privileged containers * [`5b66cd6a0`](containerd@5b66cd6) Move cgroup namespace placement higher in spec builder * update runc binary to v1.3.5 ([containerd#13061](containerd#13061)) * [`584205c2f`](containerd@584205c) [release/2.2] update runc binary to v1.3.5 * Fix vagrant on CI ([containerd#13066](containerd#13066)) * [`77c6886df`](containerd@77c6886) Ignore NOCHANGE error * Fix TOCTOU race bug in tar extraction ([containerd#12971](containerd#12971)) * [`fbed68b8f`](containerd@fbed68b) Fix TOCTOU race bug in tar extraction * cri: UpdatePodSandbox should return Unimplemented ([containerd#13023](containerd#13023)) * [`a83510103`](containerd@a835101) cri: UpdatePodSandbox should return Unimplemented * fix(oci): apply absolute symlink resolution to /etc/group ([containerd#13019](containerd#13019)) * [`ee4179e52`](containerd@ee4179e) fix(oci): apply absolute symlink resolution to /etc/group * fix(oci): handle absolute symlinks in rootfs user lookup ([containerd#13015](containerd#13015)) * [`fd061b848`](containerd@fd061b8) test(oci): use fstest and mock fs for better symlink coverage * [`5d44d2c22`](containerd@5d44d2c) fix(oci): handle absolute symlinks in rootfs user lookup * update to go1.25.8, test go1.26.1 ([containerd#13011](containerd#13011)) * [`00c776f07`](containerd@00c776f) update to go1.25.8, test go1.26.1 </p> </details> * **github.com/Microsoft/hcsshim** v0.14.0-rc.1 -> v0.14.1 * **github.com/klauspost/compress** v1.18.1 -> v1.18.5 * **github.com/moby/spdystream** v0.5.0 -> v0.5.1 Previous release can be found at [v2.2.2](https://github.com/containerd/containerd/releases/tag/v2.2.2) * `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04). * `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent. In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases) and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too. See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

github-project-automation Bot added this to Pull Request Review Apr 8, 2026

github-project-automation Bot moved this to Needs Triage in Pull Request Review Apr 8, 2026

k8s-ci-robot added the size/S label Apr 8, 2026

dosubot Bot added the area/toolchain Build and Release Toolchain label Apr 8, 2026

samuelkarp approved these changes Apr 8, 2026

View reviewed changes

estesp approved these changes Apr 8, 2026

View reviewed changes

github-project-automation Bot moved this from Needs Triage to Review In Progress in Pull Request Review Apr 8, 2026

samuelkarp moved this from Review In Progress to Merge on Green in Pull Request Review Apr 8, 2026

chrishenzie mentioned this pull request Apr 8, 2026

[release/2.0] update to Go 1.25.9, 1.26.2 #13191

Closed

samuelkarp merged commit 17847ac into containerd:release/2.2 Apr 9, 2026
123 of 129 checks passed

github-project-automation Bot moved this from Merge on Green to Done in Pull Request Review Apr 9, 2026

thaJeztah deleted the 2.2_bump_go branch April 9, 2026 06:55

samuelkarp mentioned this pull request Apr 13, 2026

[release/2.2] Prepare release notes for v2.2.3 #13224

Merged

BrewTestBot mentioned this pull request Apr 14, 2026

containerd 2.2.3 Homebrew/homebrew-core#277578

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release/2.2] update to Go 1.25.9, 1.26.2#13190

[release/2.2] update to Go 1.25.9, 1.26.2#13190
samuelkarp merged 1 commit intocontainerd:release/2.2from
thaJeztah:2.2_bump_go

thaJeztah commented Apr 8, 2026

Uh oh!

samuelkarp commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

thaJeztah commented Apr 8, 2026

Uh oh!

samuelkarp commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants