Plan
active
containerd 2.3.7 patches CVE-2026-95839 and multiple hardenings
- Platform/SRE — Plan: CVE-2026-95839 is not KEV-listed and no active exploitation is reported, but this patch hardens symlink handling, seccomp socket allowlisting, and image reference validation in the container runtime — all within the production-critical containerd path. Schedule an upgrade to 2.3.7 across node pools within your next maintenance window; containerd 2.3 EOL is 2028-04-30, so no forced-upgrade urgency.
- CI/CD — Skip
- Leader — Skip
- Signals: containerd 2.3 EOL 2028-04-30 · CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.