containerd v1.7.33 is a critical security-focused patch release. It primary addresses several CVEs within the runtime and its dependencies, while also hardening file IO operations and refining how image labels are handled during container creation.

Address high-severity security vulnerabilities in containerd and go-jose — This release addresses multiple critical vulnerabilities (CVE-2026-53488, CVE-2026-47262) within containerd and its dependencies that could potentially compromise the host or container isolation. Patching is highly recommended for all production environments.

Implement bounded reads for user-database files — Includes protections against resource exhaustion or malicious file manipulation by ensuring that reads from user-database files (like /etc/passwd) are size-limited.

Prevent propagation of reserved labels from image configs — Prevents internal or reserved labels from being unintentionally applied to containers based on image configurations, ensuring better metadata integrity and preventing potential configuration side-effects.