# containerd v2.3.2 — containerd 2.3.2

- Product: containerd (https://whatsnew.fyi/product/containerd)
- Vendor: CNCF
- Date: 2026-06-18
- Version: v2.3.2
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.3.2
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.3.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix CVE-2026-50195
- **security** — Fix CVE-2026-53488
- **security** — Fix CVE-2026-53492
- **security** — Fix CVE-2026-53489
- **security** — Fix CVE-2026-47262
- **fixed** — Fix data race when reading shim logs on Windows
- **changed** — Allow the last host to retry on transient network errors
- **fixed** — Fix container startup failures caused by concurrent task RPC timeouts during slow container creation
- **fixed** — Filter CDI annotations on checkpoint restore
- **fixed** — Do not re-tag restored checkpoints
- **fixed** — Make checkpoint restore robust to unexpected archive content
- **fixed** — Bound user-database file reads in openUserFile
- **fixed** — Do not propagate reserved labels from image configs
- **changed** — Update golang.org/x/crypto to v0.53.0
- **changed** — Update golang.org/x/mod to v0.36.0
- **changed** — Update golang.org/x/net to v0.55.0
- **changed** — Update golang.org/x/sync to v0.21.0
- **changed** — Update golang.org/x/sys to v0.46.0
- **changed** — Update golang.org/x/term to v0.44.0

Welcome to the v2.3.2 release of containerd!

The second patch release for containerd 2.3 contains various fixes
and updates including security patches.

###### Security Updates

* **containerd**
  * [**CVE-2026-50195**](https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574)
  * [**CVE-2026-53488**](https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
  * [**CVE-2026-53492**](https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)
  * [**CVE-2026-53489**](https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388)
  * [**CVE-2026-47262**](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)

###### Highlights

* Fix a data race when reading shim logs on Windows ([#13522](https://github.com/containerd/containerd/pull/13522))

###### Image Distribution

* Allow the last host to retry on transient network errors ([#13591](https://github.com/containerd/containerd/pull/13591))

###### Runtime

* Fix container startup failures caused by concurrent task RPC timeouts during slow container creation ([#13512](https://github.com/containerd/containerd/pull/13512))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Samuel Karp
* Chris Henzie
* Akihiro Suda
* Derek McGowan
* Akhil Mohan
* Austin Vazquez
* Ben Cressey
* Brian Goff
* Maksym Pavlenko
* Sebastiaan van Stijn
* Sergey Kanzhelev

###### Changes
<details><summary>30 commits</summary>
<p>

* Prepare release notes for v2.3.2 ([#13627](https://github.com/containerd/containerd/pull/13627))
  * [`fb8ca00b0`](https://github.com/containerd/containerd/commit/fb8ca00b051fa9a9187502b16620fdb46595f1b7) Prepare release notes for v2.3.2
  * [`9c69960ba`](https://github.com/containerd/containerd/commit/9c69960ba495c0aa08797be3f17b3c7712d17a22) Merge commit from fork
  * [`0f6251520`](https://github.com/containerd/containerd/commit/0f6251520569a25f0b52158a97d035726e6af9d2) Merge commit from fork
  * [`91d7471e2`](https://github.com/containerd/containerd/commit/91d7471e2cc7113c31dbcc62007756ba88f8cf9f) cri: filter CDI annotations on checkpoint restore
  * [`7c2e086bf`](https://github.com/containerd/containerd/commit/7c2e086bf31a4402cc19817df3b05ffd74d454e6) Merge commit from fork
  * [`dae67765f`](https://github.com/containerd/containerd/commit/dae67765f2d51ca3e67190c26e51edf496dd4cf4) cri: do not re-tag restored checkpoints
  * [`94aa1e2c1`](https://github.com/containerd/containerd/commit/94aa1e2c1a6ebadf2578fabe85ba7845e1e553c0) Merge commit from fork
  * [`09599078f`](https://github.com/containerd/containerd/commit/09599078f66bb98f6e83087893e3f2349b019fe7) cri: make checkpoint restore robust to unexpected archive content
  * [`e1fdb8d22`](https://github.com/containerd/containerd/commit/e1fdb8d221a27ce017264875e3658d021511ba0c) Merge commit from fork
  * [`ff1d116ef`](https://github.com/containerd/containerd/commit/ff1d116ef9c2d7505306d7d367ef46ff0756460b) Bound user-database file reads in openUserFile
  * [`d156e07cb`](https://github.com/containerd/containerd/commit/d156e07cbe61331f77b72e3603d8b6d67dda59e5) Merge commit from fork
  * [`f99aad54a`](https://github.com/containerd/containerd/commit/f99aad54af507168a1393dfae1559fde4cae9b2c) Do not propagate reserved labels from image configs
* vendor: golang.org/x/crypto v0.53.0 ([#13608](https://github.com/containerd/containerd/pull/13608))
  * [`0b9469501`](https://github.com/containerd/containerd/commit/0b9469501257584fc8ff32c8160dbda3501e99cc) [release/2.3] vendor: golang.org/x/crypto v0.53.0
* resolver: retry on transient network errors ([#13591](https://github.com/containerd/containerd/pull/13591))
  * [`983bbddc1`](https://github.com/containerd/containerd/commit/983bbddc139c607700259a2bec519e7026018c6f) resolver: retry on transient network errors
* update runc binary to v1.4.3 ([#13601](https://github.com/containerd/containerd/pu

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.3.2]_