GO-2026-5746 Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker

The Docker daemon's implementation of the "PUT /containers/id/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted,...

GO-2026-5617 Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection

A race condition in the Docker daemon allows an attacker to redirect bind mounts to arbitrary host paths during a "docker cp" operation. The affected code is in the daemon package, specifically the openContainerFS method. This is daemon-owned, Linux-specific code and is not intended for external...

GO-2026-4887 Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker

Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker...

GO-2026-4883 Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker

Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker...

Exploit for CVE-2024-40635

CVE-2024-40635POC Proof of Concept code for proving CVE-2024-...

CVE-2024-36621

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion...

CVE-2024-29018

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature i...