Hi,

The following vulnerabilities were published for containerd.

CVE-2026-95837[0]:
| containerd is an open-source container runtime. From 2.1.0 until
| 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore
| is vulnerable because CRIU restores process security state from
| checkpoint data instead of enforcing the destination
| ContainerConfig. An attacker who can create a container from a
| crafted checkpoint can supply restored credentials, capabilities,
| no_new_privs, and seccomp state. The restored process can run as
| root with full capabilities and no enforced seccomp filters while
| CRI status reports the requested configuration. Systems that do not
| use CRI checkpoint restore are not affected. This issue is fixed in
| versions 2.2.7 and 2.3.4.


CVE-2026-95838[1]:
| containerd is an open-source container runtime. Prior to 1.7.35,
| 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler
| repeatedly traverses directories for certain opaque whiteout
| configurations. A malicious image layer can trigger repeated
| directory traversals while opaque whiteouts are processed. Pulling
| or importing the image can consume CPU, delay container startup, and
| reduce image-pull concurrency for unrelated deployments. This issue
| is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-95837
https://www.cve.org/CVERecord?id=CVE-2026-95837
https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f
[1] https://security-tracker.debian.org/tracker/CVE-2026-95838
https://www.cve.org/CVERecord?id=CVE-2026-95838
https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore