# containerd v2.3.5 — containerd 2.3.5

- Product: containerd (https://whatsnew.fyi/product/containerd)
- Vendor: CNCF
- Date: 2026-09-04
- Version: v2.3.5
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.3.5
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.3.5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Address CVE-2026-53495
- **security** — Address GHSA-rp3h-jf77-q9p4
- **security** — Strip sensitive authentication headers when fetching descriptor URLs
- **fixed** — Avoid hangs and data races when streaming container standard I/O in CRI
- **fixed** — Fix missing error messages in OpenTelemetry trace attributes
- **fixed** — Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group
- **fixed** — Fix configuration loading error when drop-in configuration files have a higher version than the root configuration
- **fixed** — Avoid containerd startup hangs when loading shims
- **fixed** — Add context to error when shim delete times out
- **fixed** — Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC
- **fixed** — Fix unpack failure for EROFS images containing the erofs OS feature
- **changed** — Update runc to v1.5.1
- **changed** — Update runhcs to v0.15.0-rc.4
- **changed** — Vendor github.com/containerd/platforms v1.0.0-rc.5

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes
and updates including security patches.

###### Security Updates

* **containerd**
  * [**CVE-2026-53495**](https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv)
  * [**GHSA-rp3h-jf77-q9p4**](https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4)

###### Highlights

###### Image Distribution

* Apply hardening to strip sensitive authentication headers when fetching descriptor URLs ([#14030](https://github.com/containerd/containerd/pull/14030))

###### Runtime

* Avoid hangs and data races when streaming container standard I/O in CRI ([#14094](https://github.com/containerd/containerd/pull/14094))
* Fix missing error messages in OpenTelemetry trace attributes ([#14049](https://github.com/containerd/containerd/pull/14049))
* Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ([#13999](https://github.com/containerd/containerd/pull/13999))
* Fix configuration loading error when drop-in configuration files have a higher version than the root configuration ([#13995](https://github.com/containerd/containerd/pull/13995))
* Avoid containerd startup hangs when loading shims ([#13983](https://github.com/containerd/containerd/pull/13983))
* Add context to error when shim delete times out ([#13921](https://github.com/containerd/containerd/pull/13921))
* Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC ([containerd/platforms#34](https://github.com/containerd/platforms/pull/34))

###### Snapshotters

* Fix unpack failure for EROFS images containing the erofs OS feature ([#14062](https://github.com/containerd/containerd/pull/14062))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Phil Estes
* Samuel Karp
* Derek McGowan
* Sebastiaan van Stijn
* Akhil Mohan
* Maksym Pavlenko
* Wei Fu
* Oleh Konko
* Austin Vazquez
* Jing Chen
* Martín Fernández
* Paco Xu
* XlabAI
* Yuanliang Zhang

###### Changes
<details><summary>33 commits</summary>
<p>

  * [`934efa5e0`](https://github.com/containerd/containerd/commit/934efa5e09193139c810bcab1fb5ca547dbb6b90) Prepare release notes for v2.3.5
  * [`be419b070`](https://github.com/containerd/containerd/commit/be419b070c178548c8e384d8bc3c8fe0ad6f154a) Merge commit from fork
  * [`9ec55f024`](https://github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaa) cri: cancel ExecSync IO drain on context cancellation
  * [`84ea25bc1`](https://github.com/containerd/containerd/commit/84ea25bc1d7e9f71390ce9d647dbdec4408c05bc) Merge commit from fork
  * [`c53577965`](https://github.com/containerd/containerd/commit/c535779652bc8d541328a36ba598088c09819b97) archive: skip redundant opaque whiteout walks
* Fix data races and a deadlock in the byte stream helpers ([#14094](https://github.com/containerd/containerd/pull/14094))
  * [`9f6be869c`](https://github.com/containerd/containerd/commit/9f6be869c8a6144dc66befde081d6e262b7c4c7d) Fix data races and a deadlock in the byte stream helpers
* plugins: remove some stray logrus imports ([#14063](https://github.com/containerd/containerd/pull/14063))
  * [`6c59399bf`](https://github.com/containerd/containerd/commit/6c59399bf07df45110770dbe28710e2e65c3e8c6) plugins: remove some stray logrus imports
* snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin ([#14062](https://github.com/containerd/containerd/pull/14062))
  * [`f65732115`](https://github.com/containerd/containerd/commit/f65732115d1319a62fd35dc694d5fbe3045594f7) snapshots/erofs: test the advertised erofs feature platform
  * [`5ffc2bbda`](https://github.com/containerd/containerd/commit/5ffc2bbda2a878f87b56ffa2496157f3b814fbc1) erofs: advertise the erofs OS feature platform from the snapshotter
* update runc to v1.5.1 ([#14059](https://github.c

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.3.5]_