Security advisories

high2026-05-18

CVE-2026-42306-Docker: Race condition in docker cp allows bind mount redirection to host path

GHSA-rg2x-37c3-w2rh

medium2026-05-18

CVE-2026-41568-Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap

GHSA-vp62-88p7-qqf5

high2026-05-18

CVE-2026-41567-Docker: `PUT /containers/{id}/archive` executes container binary on the host

GHSA-x86f-5xw2-fm2r

high2026-03-27

CVE-2026-34040-Moby has AuthZ plugin bypass when provided oversized request bodies

GHSA-x744-4wpc-v9h2

medium2026-03-27

CVE-2026-33997-Moby has an Off-by-one error in its plugin privilege validation

GHSA-pxq6-2prw-chj9

low2025-07-29

CVE-2025-54410-Moby firewalld reload removes bridge network isolation

GHSA-4vq8-7jfc-9cvp

medium2025-07-29

CVE-2025-54388-Moby firewalld reload makes published container ports accessible from remote hosts

GHSA-x4rx-4gw3-53p4

medium2024-11-29

CVE-2024-36620-NULL Pointer Dereference on moby image history

GHSA-q59j-vv4j-v33c

high2024-11-29

CVE-2024-36623-Moby Race Condition vulnerability

GHSA-gh5c-3h97-2f3q

high2024-11-29

CVE-2024-36621-Moby Race Condition vulnerability

GHSA-2mj3-vfvx-fc43

critical2024-07-30

CVE-2024-41110-Authz zero length regression

GHSA-v23v-6jw2-98fq

low2024-06-10

CVE-2021-41089-`docker cp` allows unexpected chmod of host files in Moby Docker Engine

GHSA-v994-f8vw-g7j4

medium2024-04-22

CVE-2022-24769-Moby (Docker Engine) started with non-empty inheritable Linux process capabilities

GHSA-2mm7-x5h6-5pvq

medium2024-04-18

CVE-2024-32473-IPv6 enabled on IPv4-only network interfaces

GHSA-x84c-p2g9-rqv9

medium2024-03-20

CVE-2024-29018-Moby's external DNS requests from 'internal' networks could lead to data exfiltration

GHSA-mq39-4gv4-mvpx

medium2024-02-01

CVE-2024-24557-Classic builder cache poisoning

GHSA-xw73-rw38-6vjc

medium2024-01-31

CVE-2021-41091-Moby (Docker Engine) Insufficiently restricted permissions on data directory

GHSA-3fwx-pjgw-3558

high2024-01-31

CVE-2018-12608-Docker Authentication Bypass

GHSA-qrqr-3x5j-2xw9

medium2023-10-30

/sys/devices/virtual/powercap accessible by default to containers

GHSA-jq35-85cj-fj4p

high2023-04-04

CVE-2023-28840-Docker Swarm encrypted overlay network may be unauthenticated

GHSA-232p-vwff-86mp