…3.1 [security] (#2606)

This PR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
|
[github.com/containerd/containerd/v2](https://redirect.github.com/containerd/containerd)
| indirect | patch | `v2.3.0` → `v2.3.1` | [![OpenSSF
Scorecard](https://api.securityscorecards.dev/projects/github.com/containerd/containerd/badge)](https://securityscorecards.dev/viewer/?uri=github.com/containerd/containerd)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/331) for more information.

---

### containerd user ID handling bypass allows runAsNonRoot evasion
[CVE-2026-46680](https://nvd.nist.gov/vuln/detail/CVE-2026-46680) /
[GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)

<details>
<summary>More information</summary>

#### Details
##### Impact
A bug was found in containerd where containers launched with a numeric
`User` directive that cannot be parsed as a 32-bit integer are
incorrectly treated as a username. If a crafted image provides an
`/etc/passwd` file mapping this large numeric string to root, the
container ultimately runs as root (UID 0). This allows the Kubernetes
`runAsNonRoot` restriction to be bypassed, causing unexpected behavior
for environments that require containers to run as a non-root user.

##### Patches
This bug has been fixed in the following containerd versions:

* 2.3.1
* 2.2.4
* 2.0.9
* 1.7.32

Note: The containerd 2.1 release has reached its [end of
life](https://containerd.io/releases/#current-state-of-containerd-releases)
and a fixed version is not provided.

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images are used and that only trusted users
have permissions to import images. Alternatively, enforcing a specific
numeric `runAsUser` in the Kubernetes Pod `securityContext` overrides
the `USER` directive in the image and prevents the bypass. Newer
versions of Kubernetes, starting with 1.34, also appear to enforce
`runAsNonRoot` properly regardless of this bug.

##### Credits
The containerd project would like to thank Lei Wang (@&#8203;ssst0n3)
for responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### Resources
* GHSA-265r-hfxg-fhmg (CVE-2024-40635)

##### For more information

If there are any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Send an email to
[security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Send an email to
[security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 7.3 / 10 (High)
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w)
-
[https://github.com/advisories/GHSA-fqw6-gf59-qr4w](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-fqw6-gf59-qr4w)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>containerd/containerd
(github.com/containerd/containerd/v2)</summary>

###
[`v2.3.1`](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.1):
containerd 2.3.1

[Compare
Source](https://redirect.github.com/containerd/containerd/compare/v2.3.0...v2.3.1)

Welcome to the v2.3.1 release of containerd!

The first patch release for containerd 2.3 contains various fixes and
improvements.

##### Security Updates

-
[**CVE-2026-46680**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w)

##### Highlights

- Fix bug where failed gRPC plugins were not tolerated when starting
listeners
([#&#8203;13390](https://redirect.github.com/containerd/containerd/pull/13390))

##### Image Storage

- Ensure metadata and mount plugin boltdb files are closed on server
shutdown
([#&#8203;13379](https://redirect.github.com/containerd/containerd/pull/13379))

##### Runtime

- Fix handling of out-of-range USER values in OCI spec to avoid
unexpected username/group lookups
([#&#8203;13447](https://redirect.github.com/containerd/containerd/pull/13447))
- Fix sandbox task API endpoints for non-runc runtimes and deprecate
task fields in Runc options
([#&#8203;13422](https://redirect.github.com/containerd/containerd/pull/13422))
- Apply hardening to default seccomp socket policy by blocking AF\_ALG
([#&#8203;13409](https://redirect.github.com/containerd/containerd/pull/13409))

##### Snapshotters

- Disable overlayfs "rebase" capability when running in user namespace
([#&#8203;13394](https://redirect.github.com/containerd/containerd/pull/13394))
- Fix transfer plugin error when EROFS differ is configured but
mkfs.erofs is unavailable
([#&#8203;13364](https://redirect.github.com/containerd/containerd/pull/13364))

Please try out the release binaries and report any issues at
<https://github.com/containerd/containerd/issues>.

##### Contributors

- Maksym Pavlenko
- Akihiro Suda
- Derek McGowan
- Paweł Gronowski
- Brian Goff
- Austin Vazquez
- LEI WANG
- Samuel Karp

##### Changes

<details><summary>24 commits</summary>
<p>

- Prepare release notes for v2.3.1
([#&#8203;13405](https://redirect.github.com/containerd/containerd/pull/13405))
-
[`58af96519`](https://redirect.github.com/containerd/containerd/commit/58af9651939577f81969b387b6b2e2aed45ead7d)
Prepare release notes for v2.3.1
-
[`8f0b3ca83`](https://redirect.github.com/containerd/containerd/commit/8f0b3ca83015873d643db246202b63b8384f14fd)
Update api to v1.11.1
- oci: return explicit error for out-of-range USER values
([#&#8203;13447](https://redirect.github.com/containerd/containerd/pull/13447))
-
[`a05ae7885`](https://redirect.github.com/containerd/containerd/commit/a05ae78850384eb24effbc597ebc5b19a5e4ba04)
oci: return explicit error for out-of-range USER values
- Prepare release notes for api/v1.11.1
([#&#8203;13444](https://redirect.github.com/containerd/containerd/pull/13444))
-
[`da7aef299`](https://redirect.github.com/containerd/containerd/commit/da7aef299c57cc1f290700ade8fa0a5fec69a462)
Prepare release notes for api/v1.11.1
- Fix sandbox task API endpoints for non-runc runtimes
([#&#8203;13422](https://redirect.github.com/containerd/containerd/pull/13422))
-
[`5282d4e09`](https://redirect.github.com/containerd/containerd/commit/5282d4e09d3bc8b0957780caa7a4644fac7c86a7)
Wire task address and version fields
-
[`e44f5f9ec`](https://redirect.github.com/containerd/containerd/commit/e44f5f9ec610d95a712d230e8a19ae516e0a26ac)
protos: include task API address to CreateTaskRequest
- seccomp: Block AF\_ALG in default socket policy
([#&#8203;13409](https://redirect.github.com/containerd/containerd/pull/13409))
-
[`4d80a31bf`](https://redirect.github.com/containerd/containerd/commit/4d80a31bf637bc15e83e50a15941bf5bb0cb3988)
seccomp: Block AF\_ALG in default socket policy
-
[`2ed0d97b6`](https://redirect.github.com/containerd/containerd/commit/2ed0d97b6e58def34684a1bffc2ab6931182f221)
seccomp: Document socket rule scope and socketcall limitation
- server: tolerate failed gRPC plugins when starting listeners
([#&#8203;13390](https://redirect.github.com/containerd/containerd/pull/13390))
-
[`3a88fdde0`](https://redirect.github.com/containerd/containerd/commit/3a88fdde0c613e62415e61738e946b903f1bf32f)
server: tolerate failed gRPC plugins when starting listeners
- overlay: disable "rebase" capability when running in UserNS
([#&#8203;13394](https://redirect.github.com/containerd/containerd/pull/13394))
-
[`2be0710b8`](https://redirect.github.com/containerd/containerd/commit/2be0710b81b99f47aa4ef0fa2951cd69f80b7e19)
overlay: disable "rebase" capability when running in UserNS
- Update Go to 1.26.3
([#&#8203;13374](https://redirect.github.com/containerd/containerd/pull/13374))
-
[`3b199c22b`](https://redirect.github.com/containerd/containerd/commit/3b199c22b13495bd442b32121c2015f301594387)
Update Go to 1.26.3
- fix: close boltdb on metadata and mount plugin close
([#&#8203;13379](https://redirect.github.com/containerd/containerd/pull/13379))
-
[`1d601271a`](https://redirect.github.com/containerd/containerd/commit/1d601271a73a649de465ed94fa973564211b7f46)
fix: close boltdb on metadata and mount plugin close
- Fix optional EROFS differ setup in transfer plugin
([#&#8203;13364](https://redirect.github.com/containerd/containerd/pull/13364))
-
[`d666d2e42`](https://redirect.github.com/containerd/containerd/commit/d666d2e4261da664a50c7b1663461747ba8ebb2e)
Refactor transfer unpack configuration setup
-
[`ccc3bd7b9`](https://redirect.github.com/containerd/containerd/commit/ccc3bd7b90be7afce7a903391d2a34b83424c5e0)
Fix optional transfer differ setup

</p>
</details>

##### Dependency Changes

- **github.com/containerd/containerd/api**  v1.11.0 -> v1.11.1

Previous release can be found at
[v2.3.0](https://redirect.github.com/containerd/containerd/releases/tag/v2.3.0)

##### Which file should I download?

- `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically
linked with glibc 2.35 (Ubuntu 22.04).
- `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked.
Expected to be used on Linux distributions that do not use glibc >=
2.35. Not position-independent.

In addition to containerd, typically you will have to install
[runc](https://redirect.github.com/opencontainers/runc/releases)
and [CNI
plugins](https://redirect.github.com/containernetworking/plugins/releases)
from their official sites too.

See also the [Getting
Started](https://redirect.github.com/containerd/containerd/blob/main/docs/getting-started.md)
documentation.

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTEuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5MS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: ocmbot[bot] <125909804+ocmbot[bot]@users.noreply.github.com> 35e9191