Every CVE Search/ Get API key

CVE-2026-17106

Tar extraction in moby/go-archive can write outside the destination directory via link following

7.1 HighPublic exploitFix available

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.44%Up 0.2 points since Aug 19, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
CVE-2026-17106
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-59
Updated
2026-11-02
EUVDEUVD-2026-61112 7.1

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
EUVD-2026-61112
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hfg8-hc9c-6c3h 7.1

moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact

An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds

Only extract trusted archives.

Record
GHSA-hfg8-hc9c-6c3h
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
NVD 7.1

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
CVE-2026-17106
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-59
Updated
2026-11-02
OSV 7.1

Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
CVE-2026-17106
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-59
Updated
2026-11-02
OSVDEBIAN-CVE-2026-17106 7.1

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
DEBIAN-CVE-2026-17106
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 23 moreShow less
OSVGHSA-hfg8-hc9c-6c3h 7.1

moby/go-archive: Crafted tar archive can write outside the extraction directory

Summary

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination.

Details

The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so a links introduced by the archive can be followed out of the destination directory.

Impact

An attacker who controls the contents of archive can create or overwrite files at arbitrary paths writable by the extracting process.

Workarounds

Only extract trusted archives.

Record
GHSA-hfg8-hc9c-6c3h
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSVOESA-2026-3526 7.1

docker security update

Docker is a product for you to build, ship and run any application as a lightweight container.

Security Fix(es):

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.(CVE-2026-17106)

Record
OESA-2026-3526
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVRHSA-2026:52807 7.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:52807
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:69961 8.1

Red Hat Security Advisory: podman security update

Record
RHSA-2026:69961
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:70201 8.8

Red Hat Security Advisory: podman security update

Record
RHSA-2026:70201
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRLSA-2026:69961 8.1

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

  • podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

  • podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

  • podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

  • podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

  • podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730)

  • podman: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

  • podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

  • podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69961
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:70201 8.8

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

  • podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

  • podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

  • podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

  • podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

  • podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

  • podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

  • podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)

  • podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

  • podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730)

  • podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:70201
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-17106 7.1

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
UBUNTU-CVE-2026-17106
CVSS 4.0
7.1 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:69961 No score

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
  • podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
  • podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730)
  • podman: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
  • podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  • podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69961
Updated
2026-11-02
OSVALSA-2026:70201 No score

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

  • podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
  • podman: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
  • podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
  • podman: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
  • podman: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
  • podman: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
  • podman: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
  • podman: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
  • podman: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
  • podman: Quadlet install --replace non-truncating write retains removed host-access directives (CVE-2026-19730)
  • podman: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:70201
Updated
2026-11-02
OSVAZL-97004 No score

CVE-2026-17106 affecting package docker-cli for versions less than 25.0.7-5

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
AZL-97004
Updated
2026-11-05
OSVAZL-97007 No score

CVE-2026-17106 affecting package moby-engine for versions less than 25.0.3-20

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
AZL-97007
Updated
2026-11-05
OSVBIT-docker-cli-2026-17106 No score

Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.

Record
BIT-docker-cli-2026-17106
Updated
2026-11-02
OSVGO-2026-6253 No score

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

Record
GO-2026-6253
Updated
2026-11-02
OSVopenSUSE-SU-2026:11544-1 No score

apptainer-1.5.3-2.1 on GA media

These are all security issues fixed in the apptainer-1.5.3-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11544-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12068-1 No score

podman-6.1.2-1.1 on GA media

These are all security issues fixed in the podman-6.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12068-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12260-1 No score

buildpacks-cli-0.40.10-1.1 on GA media

These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12260-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12341-1 No score

buildah-1.46.0-1.1 on GA media

These are all security issues fixed in the buildah-1.46.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12341-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21611-1 No score

Security update for apptainer

This update for apptainer fixes the following issues:

Changes in apptainer:

  • Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106: The tar extraction routines in moby/go-archive do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination (bsc#1275248).
Record
openSUSE-SU-2026:21611-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
openSUSE-SU-2026:21761-1
Updated
2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-17106 No score

CVE-2026-17106 in github.com/moby/go-archive - Patched by Root

Root has patched CVE-2026-17106 in the github.com/moby/go-archive package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2026-17106
Updated
2026-11-02
OSVSUSE-SU-2026:23625-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-5026 CVE-2026-39821
    • GO-2026-6225
    • GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
    • GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
    • GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
    • GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
    • GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
    • GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
    • GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
    • GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
    • GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
    • GO-2026-6262 GHSA-22w5-2fxg-vrwx
    • GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
    • GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
    • GO-2026-6265 GHSA-8fxq-53rx-ph5f
    • GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
    • GO-2026-6267 GHSA-h58c-xccx-75m3
    • GO-2026-6268 GHSA-q9c5-pp7m-fm2g
    • GO-2026-6269 GHSA-rxhg-vcww-2mpw
    • GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
    • GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
    • GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
    • GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
    • GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
    • GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
    • GO-2026-6277 GHSA-4ph6-mjv7-3fq6
    • GO-2026-6278 GHSA-w67g-5rqw-f597
    • GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
    • GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
    • GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
    • GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
    • GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
    • GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
    • GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
    • GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
    • GO-2026-6287 GHSA-vx2m-jpxr-xv7w
    • GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
    • GO-2026-6289 GHSA-w8j7-39hp-8x59
    • GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
    • GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
    • GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
    • GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
    • GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
    • GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
    • GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
    • GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
    • GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
    • GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
    • GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
    • GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf

  • Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.

    Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2026-4720 GHSA-v3mg-9v85-fcm7
    • GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
    • GO-2026-4950
    • GO-2026-6093 GHSA-464c-974j-9xm6
    • GO-2026-6094 GHSA-gcjh-h69q-9w9g
    • GO-2026-6095 GHSA-r277-6w6q-xmqw
    • GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
    • GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
    • GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
    • GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
    • GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
    • GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
    • GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
    • GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
    • GO-2026-6105 GHSA-c534-2w9c-x7fm
    • GO-2026-6106 GHSA-v6w6-358x-2433
    • GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
    • GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
    • GO-2026-6109 GHSA-86cx-wwf4-phq4
    • GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
    • GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
    • GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
    • GO-2026-6113 GHSA-p6ph-3jx2-3337
    • GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
    • GO-2026-6115 CVE-2026-56867
    • GO-2026-6117 GHSA-hp74-gm6m-2qm5
    • GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
    • GO-2026-6119 CVE-2026-43983…
Record
SUSE-SU-2026:23625-1
Updated
2026-11-02
OSVSUSE-SU-2026:3863-1 No score

Security update for apptainer

This update for apptainer fixes the following issue:

  • CVE-2026-17106: github.com/moby/go-archive: tar extraction routines do not confine filesystem operations to the destination directory and allow for arbitrary file writes (bsc#1275248).
Record
SUSE-SU-2026:3863-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/moby/go-archive
Go
 before 0.3.0
0.3.0
podman
AlmaLinux:9
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-docker
AlmaLinux:9
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-plugins
AlmaLinux:9
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-remote
AlmaLinux:9
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-tests
AlmaLinux:9
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman
AlmaLinux:10
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2.alma.1
7:5.8.2-9.el10_2.alma.1
podman-docker
AlmaLinux:10
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2.alma.1
7:5.8.2-9.el10_2.alma.1
podman-remote
AlmaLinux:10
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2.alma.1
7:5.8.2-9.el10_2.alma.1
podman-tests
AlmaLinux:10
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2.alma.1
7:5.8.2-9.el10_2.alma.1
Show 66 moreShow less
Affected packages
PackageAffectedFixed
docker-cli
Azure Linux:3
 before 25.0.7-5
25.0.7-5
moby-engine
Azure Linux:3
 before 25.0.3-20
25.0.3-20
podman
Alpaquita:23
 4.3.1-r0 up to 5.6.2-r13
5.6.2-r13
buildah
Alpaquita:25
 1.40.0-r0 up to 1.41.8-r8
1.41.8-r8
docker-cli-buildx
Alpaquita:25
 0.24.0-r0 up to 0.24.0-r15
0.24.0-r15
podman
Alpaquita:25
 5.5.0-r0 up to 5.6.2-r13
5.6.2-r13
buildah
Alpaquita:stream
 1.31.0-r0 up to 1.44.0-r6
1.44.0-r6
docker-cli-buildx
Alpaquita:stream
 0.11.0-r0 up to 0.36.1-r3
0.36.1-r3
podman
Alpaquita:stream
 4.5.1-r1 up to 5.8.6-r3
5.8.6-r3
docker-cli
Bitnami
 before 29.7.0
29.7.0
golang-github-moby-go-archive
Debian:14
 before 0.3.3-1, plus listed versions
0.2.0-1
0.3.3-1
docker
openEuler:20.03-LTS-SP4
 before engine-18.09.0-276.oe2003sp4
engine-18.09.0-276.oe2003sp4
docker
openEuler:22.03-LTS-SP4
 before engine-18.09.0-351.oe2203sp4
engine-18.09.0-351.oe2203sp4
docker
openEuler:24.03-LTS-SP1
 before engine-18.09.0-354.oe2403sp1
engine-18.09.0-354.oe2403sp1
docker
openEuler:24.03-LTS-SP3
 before engine-18.09.0-354.oe2403sp3
engine-18.09.0-354.oe2403sp3
docker
openEuler:24.03-LTS-SP4
 before engine-18.09.0-354.oe2403sp4
engine-18.09.0-354.oe2403sp4
podman
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:6.0.2-2.2.hum1
0:6.0.2-2.2.hum1
podman-docker
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:6.0.2-2.2.hum1
0:6.0.2-2.2.hum1
podman-machine
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:6.0.2-2.2.hum1
0:6.0.2-2.2.hum1
podman-remote
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:6.0.2-2.2.hum1
0:6.0.2-2.2.hum1
podmansh
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:6.0.2-2.2.hum1
0:6.0.2-2.2.hum1
podman
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-docker
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-plugins
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-plugins-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-remote
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-remote-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-tests
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman-docker
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman-remote
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman-remote-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman-tests-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman-tests
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
podman
Rocky Linux:9
From an advisory covering 9 CVEs
 before 6:5.8.2-7.el9_8
6:5.8.2-7.el9_8
podman
Rocky Linux:10
From an advisory covering 11 CVEs
 before 7:5.8.2-9.el10_2
7:5.8.2-9.el10_2
github.com/moby/go-archive
Root:Go
 before v0.2.0-aikido.1
v0.2.0-aikido.1
rootio-github.com/moby/go-archive
Root:Go
 before v0.2.0-root.io.1
v0.2.0-root.io.1
govulncheck-vulndb
SUSE:Linux Enterprise Server 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
govulncheck-vulndb
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1
apptainer
SUSE:Linux Enterprise Module for HPC 15 SP7
 before 1.5.3-150600.4.37.1
1.5.3-150600.4.37.1
apptainer
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 1.5.3-150600.4.37.1
1.5.3-150600.4.37.1
apptainer
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.5.3-150600.4.37.1
1.5.3-150600.4.37.1
docker.io
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.6.2~dfsg1-1ubuntu41.10.2-0ubuntu31.10.2-0ubuntu41.10.3-0ubuntu11.10.3-0ubuntu4
Show 19 moreShow less
1.10.3-0ubuntu51.10.3-0ubuntu61.11.2-0ubuntu5~16.041.12.1-0ubuntu13~16.04.11.12.3-0ubuntu4~16.04.21.12.6-0ubuntu1~16.04.11.13.1-0ubuntu1~16.04.217.03.2-0ubuntu2~16.04.118.06.1-0ubuntu1~16.04.218.06.1-0ubuntu1.2~16.04.118.09.2-0ubuntu1~16.04.118.09.5-0ubuntu1~16.04.218.09.7-0ubuntu1~16.04.118.09.7-0ubuntu1~16.04.418.09.7-0ubuntu1~16.04.518.09.7-0ubuntu1~16.04.618.09.7-0ubuntu1~16.04.718.09.7-0ubuntu1~16.04.9+esm118.09.7-0ubuntu1~16.04.9+esm2
 None known
docker.io
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.13.1-0ubuntu617.03.2-0ubuntu117.03.2-0ubuntu317.03.2-0ubuntu517.12.1-0ubuntu1
Show 22 moreShow less
18.06.1-0ubuntu1~18.04.118.06.1-0ubuntu1.2~18.04.118.09.2-0ubuntu1~18.04.118.09.5-0ubuntu1~18.04.218.09.7-0ubuntu1~18.04.118.09.7-0ubuntu1~18.04.318.09.7-0ubuntu1~18.04.419.03.6-0ubuntu1~18.04.119.03.6-0ubuntu1~18.04.219.03.6-0ubuntu1~18.04.320.10.2-0ubuntu1~18.04.220.10.2-0ubuntu1~18.04.320.10.7-0ubuntu1~18.04.120.10.7-0ubuntu1~18.04.220.10.7-0ubuntu5~18.04.220.10.7-0ubuntu5~18.04.320.10.12-0ubuntu2~18.04.120.10.21-0ubuntu1~18.04.220.10.21-0ubuntu1~18.04.320.10.21-0ubuntu1~18.04.3+esm120.10.21-0ubuntu1~18.04.3+esm220.10.21-0ubuntu1~18.04.3+esm3
 None known
docker.io
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
19.03.2-0ubuntu119.03.6-0ubuntu119.03.8-0ubuntu119.03.8-0ubuntu1.20.0419.03.8-0ubuntu1.20.04.1
Show 15 moreShow less
19.03.8-0ubuntu1.20.04.220.10.2-0ubuntu1~20.04.220.10.2-0ubuntu1~20.04.320.10.7-0ubuntu1~20.04.120.10.7-0ubuntu1~20.04.220.10.7-0ubuntu5~20.04.120.10.7-0ubuntu5~20.04.220.10.12-0ubuntu2~20.04.120.10.21-0ubuntu1~20.04.120.10.21-0ubuntu1~20.04.220.10.21-0ubuntu1~20.04.420.10.21-0ubuntu1~20.04.520.10.21-0ubuntu1~20.04.620.10.21-0ubuntu1~20.04.6+esm120.10.21-0ubuntu1~20.04.6+esm2
 None known
docker.io-app
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
20.10.25-0ubuntu1~20.04.120.10.25-0ubuntu1~20.04.224.0.5-0ubuntu1~20.04.124.0.7-0ubuntu2~20.04.126.1.3-0ubuntu1~20.04.126.1.3-0ubuntu1~20.04.1+esm126.1.3-0ubuntu1~20.04.1+esm2
 None known
docker.io
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
20.10.7-0ubuntu520.10.7-0ubuntu720.10.12-0ubuntu120.10.12-0ubuntu220.10.12-0ubuntu3
Show 11 moreShow less
20.10.12-0ubuntu3+gke1.24.120.10.12-0ubuntu420.10.21-0ubuntu1~22.04.220.10.21-0ubuntu1~22.04.320.10.21-0ubuntu1~22.04.520.10.21-0ubuntu1~22.04.620.10.21-0ubuntu1~22.04.720.10.21-0ubuntu1~22.04.7+esm120.10.21-0ubuntu1~22.04.7+esm220.10.21-0ubuntu1~22.04.820.10.21-0ubuntu1~22.04.8+esm1
 None known
docker.io-app
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
20.10.25-0ubuntu1~22.04.120.10.25-0ubuntu1~22.04.224.0.5-0ubuntu1~22.04.124.0.7-0ubuntu2~22.04.126.1.3-0ubuntu1~22.04.1
Show 6 moreShow less
26.1.3-0ubuntu1~22.04.1+esm127.5.1-0ubuntu3~22.04.127.5.1-0ubuntu3~22.04.228.2.2-0ubuntu1~22.04.129.1.3-0ubuntu3~22.04.129.1.3-0ubuntu3~22.04.2
 None known
docker.io
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
20.10.24+dfsg1-1ubuntu220.10.25+dfsg1-2ubuntu120.10.25+dfsg1-2ubuntu1+esm120.10.25+dfsg1-2ubuntu1+esm220.10.25+dfsg1-2ubuntu1.24.04.120.10.25+dfsg1-2ubuntu1.24.04.1+esm1
 None known
docker.io-app
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
24.0.5-0ubuntu124.0.7-0ubuntu124.0.7-0ubuntu224.0.7-0ubuntu324.0.7-0ubuntu4
Show 8 moreShow less
24.0.7-0ubuntu4.126.1.3-0ubuntu1~24.04.126.1.3-0ubuntu1~24.04.1+esm127.5.1-0ubuntu3~24.04.127.5.1-0ubuntu3~24.04.228.2.2-0ubuntu1~24.04.129.1.3-0ubuntu3~24.04.129.1.3-0ubuntu3~24.04.2
 None known
docker.io
Ubuntu:26.10
 All versions, plus listed versions
27.5.1+dfsg4-2ubuntu128.5.2+dfsg4-5ubuntu1
 None known
docker.io-app
Ubuntu:26.10
 All versions, plus listed versions
29.1.3-0ubuntu429.1.3-0ubuntu529.1.3-0ubuntu629.7.2-0ubuntu1
 None known
docker.io
Ubuntu:26.04:LTS
 All versions, plus listed versions
26.1.5+dfsg1-9ubuntu127.5.1+dfsg4-1ubuntu127.5.1+dfsg4-2ubuntu1
 None known
docker.io-app
Ubuntu:26.04:LTS
 All versions, plus listed versions
28.2.2-0ubuntu129.1.2-0ubuntu129.1.3-0ubuntu129.1.3-0ubuntu229.1.3-0ubuntu329.1.3-0ubuntu429.1.3-0ubuntu4.1
 None known
apptainer
openSUSE:Tumbleweed
 before 1.5.3-2.1
1.5.3-2.1
podman
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 6.1.2-1.1
6.1.2-1.1
buildpacks-cli
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 0.40.10-1.1
0.40.10-1.1
buildah
openSUSE:Tumbleweed
 before 1.46.0-1.1
1.46.0-1.1
apptainer
openSUSE:Leap 16.0
 before 1.5.3-bp160.2.1
1.5.3-bp160.2.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 181 CVEs
 before 0.0.20260827T195228-160000.1.1
0.0.20260827T195228-160000.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmasasron/CopyEscape-CVE-2026-171062026-08-09
PoC in GitHubHackSpeak/CVE-2026-171062026-08-11
PoC in GitHub686f6c61/POC-CopyEscape-CVE-2026-171062026-08-12
PoC in GitHubCompleteTech-Security/copyescape-check2026-10-23

History

History
RecordedChangedSources
affected
exploits, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-17106 is a high vulnerability (CVSS 7.1) in Moby Go-archive, published August 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in github.com/moby/go-archive 0.3.0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 123 references and the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open