Affected by GO-2026-5064
and 5 other vulnerabilities
GO-2026-5064: containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd
GO-2026-5338: containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd
GO-2026-5378: containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd
GO-2026-5475: containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd
GO-2026-5622: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd
GO-2026-5758: containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd
Validate returns nil if the string s is a valid identifier.
identifiers are similar to the domain name rules according to RFC 1035, section 2.3.1. However
rules in this package are relaxed to allow numerals to follow period (".") and mixed case is
allowed.
In general identifiers that pass this validation should be safe for use as filesystem path components.