1162 matches found
github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup
A flaw was found in the Moby container framework. A race condition occurs during the docker cp mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could...
CVE-2021-41091
CVE-2021-41091 Moby（Docker Engine）のバグにより、権限のないユーザーがディレクトリを横断し、コンテナ内のプログラムをホストマシン上で直接実行できる可能性があります。コンテナ内にSUIDプログラムが存在する場合、ユーザーはホストマシン上でそれをSUIDとして実行できます。 PoC コンテナのターミナルで docker.sh ファイルをダウンロードし、rootユーザーとして実行します: root@kitploit: wget...
CVE-2021-41091
CVE-2021-41091 该漏洞利用深入分析了 CVE-2021-41091 安全漏洞，并提供了如何利用漏洞利用脚本在主机上实现权限提升的分步指南。 漏洞概述 CVE-2021-41091 是 Moby（Docker 引擎）中的一个缺陷，由于权限限制不当，允许非特权 Linux 用户在数据目录（通常位于 /var/lib/docker）中遍历并执行程序。当容器包含具有扩展权限（例如 setuid）的可执行程序时，就会出现此漏洞。非特权 Linux 用户随后可以发现并执行这些程序，并且如果主机上用户的 UID 与容器内的文件所有者或组匹配，还可以修改文件。 Overlay 文件系统...
Astra Linux – Vulnerability in docker.io-app
Moby version 25.0.3 has a race condition vulnerability in the StreamFormatter package. This vulnerability can be exploited to trigger multiple concurrent write operations, leading to data corruption or application crashes...
Astra Linux – Vulnerability in docker.io
Moby is an open-source container framework developed by Docker Inc. It is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component dockerd, which is developed as moby/moby, is commonly referred to as Docker. Swarm Mode, which is...
CVE-2026-34040-PoC
CVE-2026-34040 — Docker/Moby AuthZ プラグイン バイパス（ラボ PoC） KO: Docker（Moby）の認可（AuthZ）プラグインを 1MB を超えるリクエストボディ でバイパスする脆弱性の実習用再現プロジェクトです。 EN: Docker（Moby）の認可（AuthZ）プラグインを 1MB を超えるリクエストボディ でバイパスする脆弱性のラボ再現です。 脆弱性の事実 / 脆弱性の詳細 項目| 値 ---|--- CVE| CVE-2026-34040 CVSS 3.1| 8.8（High）—...
CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20
CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...
CVE-2026-61711 affecting package moby-engine for versions less than 25.0.3-20
CVE-2026-61711 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...
CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20
CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...
CVE-2026-17106 affecting package moby-engine for versions less than 25.0.3-20
CVE-2026-17106 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...
AZL-99285 CVE-2026-78662 affecting package moby-engine 25.0.3-20
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...
AZL-99282 CVE-2026-56855 affecting package moby-engine 25.0.3-20
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...
AZL-99279 CVE-2026-84304 affecting package moby-containerd-cc 1.7.7-16
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
CVE-2026-17106
A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...
AZL-98385 CVE-2026-37236 affecting package moby-containerd-cc 1.7.7-16
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
GO-2026-6253 moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive
moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...
GO-2026-6256 BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit...
K000163072: Moby vulnerability CVE-2026-34040
Security Advisory Description Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins AuthZ. This issue has been patched in version 29.3.1. CVE-2026-34040 Impact There is no impact; F5...
Astra Linux – Vulnerability in docker.io-app
Moby is an open-source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tools or runtimes. Moby’s networking implementation allows for multiple networks to be defined, each with its own IP address range and gateway. This feature is...