Package
kargo-1.9
Component
github.com/containerd/containerd
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
CVE-2026-53492 (GHSA-33vj-92qq-66hc) affects containerd's CRI-plugin checkpoint-restore path (CDI annotation smuggling). kargo vendors github.com/containerd/containerd@v1.7.33 but the binary links only that module's errdefs error-definition package; no CRI, checkpoint, or restore code is compiled in. Symbol inspection of the shipped kargo binary shows github.com/containerd/containerd/errdefs as the sole linked package from this module, with no pkg/cri, checkpoint, or restore symbols present. The vulnerable code is not included in this package build. Upstream fixes the issue only in the v2 module line (github.com/containerd/containerd/v2 >= 2.1.9/2.2.5/2.3.2), which kargo does not use.
Status