CVE-2026-84445 affecting package moby-engine for versions less than 25.0.3-21

CVE-2026-84445 affecting package moby-engine for versions less than 25.0.3-21. A patched version of the package is available...

CVE-2026-84304 affecting package moby-engine for versions less than 25.0.3-21

CVE-2026-84304 affecting package moby-engine for versions less than 25.0.3-21. A patched version of the package is available...

AZL-106821 CVE-2026-93321 affecting package moby-engine 25.0.3-20

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...

AZL-106812 CVE-2026-93326 affecting package moby-engine 25.0.3-20

A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, fo...

AZL-106824 CVE-2026-93323 affecting package moby-engine 25.0.3-20

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...

AZL-106815 CVE-2026-93322 affecting package moby-engine 25.0.3-20

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon...

AZL-106806 CVE-2026-93320 affecting package moby-engine 25.0.3-20

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

AZL-106818 CVE-2026-93318 affecting package moby-engine 25.0.3-20

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

AZL-106809 CVE-2026-93319 affecting package moby-engine 25.0.3-20

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic...

CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20

CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...

CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20

CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...

CVE-2026-17106 affecting package moby-engine for versions less than 25.0.3-20

CVE-2026-17106 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...

CVE-2026-61711 affecting package moby-engine for versions less than 25.0.3-20

CVE-2026-61711 affecting package moby-engine for versions less than 25.0.3-20. A patched version of the package is available...

AZL-99285 CVE-2026-78662 affecting package moby-engine 25.0.3-20

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99282 CVE-2026-56855 affecting package moby-engine 25.0.3-20

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

AZL-97035 CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

AZL-97029 CVE-2026-61712 affecting package moby-engine for versions less than 25.0.3-20

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in...

CVE-2026-56852 affecting package moby-engine for versions less than 25.0.3-19

CVE-2026-56852 affecting package moby-engine for versions less than 25.0.3-19. A patched version of the package is available...

[SECURITY] Fedora 43 Update: moby-engine-29.6.2-1.fc43

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...

[SECURITY] Fedora 44 Update: moby-engine-29.6.2-1.fc44

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...