fix(deps): update vulnerable dependencies [security] (release-2.5)

[crossplane-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containerd/containerd	v1.7.33 → v1.7.35
google.golang.org/grpc	v1.83.1 → v1.83.2

---

containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service

CVE-2026-53495 / GHSA-7jxh-36q5-gcqv

More information

Details

Impact

A bug in containerd's CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd's stdio-drain goroutines indefinitely blocked. Because the I/O drain phase lacks a default timeout or context cancellation handling, repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd's CRI implementation or not running containers on Linux are not affected.

Patches

This bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue.

Workarounds

Ensure exec probes and lifecycle hooks do not launch long-lived background child processes.

Credits

The containerd project would like to thank XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com), including Guannan Wang, Zhanpeng Liu, Jiashuo Liang, and Guancheng Li, and @​IamwhatIamSY who independently discovered and responsibly disclosed this issue in accordance with the containerd security policy.

For more information

If there are any questions or comments about this advisory:

• Open an issue in containerd
• Send an email to security@containerd.io

To report a security issue in containerd:

• Report a new vulnerability
• Send an email to security@containerd.io

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv
• https://github.com/containerd/containerd
• https://github.com/containerd/containerd/releases/tag/v1.7.35
• https://github.com/containerd/containerd/releases/tag/v2.0.12
• https://github.com/containerd/containerd/releases/tag/v2.2.8
• https://github.com/containerd/containerd/releases/tag/v2.3.5

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

CVE-2026-84445 / GHSA-2v4p-qf9q-27wj

More information

Details

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

• Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.
• mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Severity

High

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj
• https://github.com/grpc/grpc-go/issues/9354
• https://github.com/grpc/grpc-go/pull/9365
• https://github.com/grpc/grpc-go/pull/9366
• https://github.com/grpc/grpc-go/pull/9367
• https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7
• https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4
• https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.82.2
• https://github.com/grpc/grpc-go/releases/tag/v1.83.2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

containerd/containerd (github.com/containerd/containerd)

v1.7.35: containerd 1.7.35

Compare Source

Welcome to the v1.7.35 release of containerd!

The thirty-fifth patch release for containerd 1.7 contains various fixes
and updates including security patches.

Security Updates

• containerd
  • CVE-2026-53495
  • GHSA-rp3h-jf77-q9p4

Highlights

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#​14046)

Runtime

• Enable log scrubbing by default on Windows (#​13889)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Oleh Konko
• Chris Henzie
• Maksym Pavlenko
• Phil Estes
• XlabAI

Changes

13 commits

• 05aa78da3 Prepare release notes for v1.7.35
• 3bd79bb36 Merge commit from fork
• 5a2a3a759 cri: cancel ExecSync IO drain on context cancellation
• 323e148f2 Merge commit from fork
• 9205b1903 archive: skip redundant opaque whiteout walks
• docker fetcher: strip sensitive headers on descriptor URLs (#​14046)
  • b01d66349 core/remotes/docker: normalize descriptor URL origins
  • b5d936dca core/remotes/docker: strip sensitive headers on desc.urls fetch
• Use ScrubLogs by default on Windows (#​13889)
  • cff94ea40 ctr: add --scrub-logs flag for Windows
  • 544e4657d cri/config: use ScrubLogs by default on Windows
• ci: bound Go fuzzing by execution count (#​13788)
  • 71e00ba9c ci: bound Go fuzzing by execution count

Dependency Changes

This release has no dependency changes

Previous release can be found at v1.7.34

v1.7.34: containerd 1.7.34

Compare Source

Welcome to the v1.7.34 release of containerd!

The thirty-fourth patch release for containerd 1.7 contains various fixes and updates.

Highlights

Container Runtime Interface (CRI)

• Fix lost container exit events when events arrive before container info is cached (#​11634)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Chris Henzie
• Samuel Karp
• Akihiro Suda
• Maksym Pavlenko
• Phil Estes
• Sopho Merkviladze
• ningmingxiao

Changes

5 commits

• Prepare release notes for v1.7.34 (#​13753)
  • 7db112471 Prepare release notes for v1.7.34
• Update go to 1.26.5/1.25.12 (#​13731)
  • c06144c85 Update go to 1.26.5/1.25.12
• ci: pin fog-json to resolve gem conflict (#​13712)
  • b84460e50 ci: pin fog-json to resolve gem conflict
• cri:fix lost container exit events if they arrive before info is cached (#​11634)
  • 2fe076ea7 cri:fix lost container exit events if they arrive before info is cached
• build(deps): bump golang.org/x/* dependencies (#​13502)
  • 862057716 bump golang.org/x/* dependencies

Dependency Changes

• golang.org/x/crypto v0.45.0 -> v0.52.0
• golang.org/x/mod v0.29.0 -> v0.35.0
• golang.org/x/net v0.47.0 -> v0.55.0
• golang.org/x/sync v0.18.0 -> v0.20.0
• golang.org/x/sys v0.38.0 -> v0.45.0
• golang.org/x/term v0.37.0 -> v0.43.0
• golang.org/x/text v0.31.0 -> v0.37.0

Previous release can be found at v1.7.33

grpc/grpc-go (google.golang.org/grpc)

v1.83.2: Release 1.83.2

Compare Source

Security

• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#​9365)
  • Special Thanks: @​winklemad

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.