A release candidate, often shortened to RC, is a version of software published for testing before the final release. Maintainers issue one when they believe the build is nearly ready, so that users can try it and report problems. If significant issues are found, another candidate may follow, and when none remain the candidate is released as the final version or replaced by one.
A release candidate is not the same as the fixed release. It can contain the changes intended for the final version, but it has not completed the project's testing and may still change or be withdrawn. Version names and image tags often include markers such as rc to show this, though naming conventions differ between projects.
This distinction is important during security response. Seeing a release candidate that mentions a fix does not mean a stable, supported fix has shipped, and a tag or package labelled as a candidate should not be assumed to be what a vendor advisory refers to. Equally, a final release can still be pending even when candidates are available, so check the project's release notes or advisory for exactly which versions are described as fixed.
Production systems should generally wait for the stable release unless there is a strong reason to run a candidate, such as an urgent exposure with no stable fix available. If you do use one, test it first, note which exact build you deployed, and plan to move to the final release as soon as it is published.