Every CVE Search/ Get API key

CVE-2024-24557

Moby classic builder cache poisoning

6.9 MediumFix available

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

0.26%Up 0.2 points since Feb 8, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.9

Moby classic builder cache poisoning

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
CVE-2024-24557
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-346, CWE-345
Updated
2026-11-02
EUVDEUVD-2024-0773 6.9

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
EUVD-2024-0773
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-xw73-rw38-6vjc 6.9

Classic builder cache poisoning

The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss.

An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.

For example, an attacker could create an image that is considered as a valid cache candidate for:

FROM scratch
MAINTAINER Pawel

when in fact the malicious image used as a cache would be an image built from a different Dockerfile.

In the second case, the attacker could for example substitute a different HEALTCHECK command.

Impact

23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint (which uses the classic builder by default).

All users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting.

Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default.

Patches

Patches are included in Moby releases:

  • v25.0.2
  • v24.0.9
  • v23.0.10

Workarounds

  • Use --no-cache or use Buildkit if possible (DOCKER_BUILDKIT=1, it's default on 23.0+ assuming that the buildx plugin is installed).
  • Use Version = types.BuilderBuildKit or NoCache = true in ImageBuildOptions for ImageBuild call.
Record
GHSA-xw73-rw38-6vjc
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-345, CWE-346
Updated
2026-11-02
NVD 6.9

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
CVE-2024-24557
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-345, CWE-346
Updated
2026-11-02
OSVALPINE-CVE-2024-24557 7.8

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
ALPINE-CVE-2024-24557
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-34275 7.8

CVE-2024-24557 affecting package moby-engine for versions less than 20.10.27-3

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
AZL-34275
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVAZL-35002 7.8

CVE-2024-24557 affecting package moby-engine for versions less than 25.0.3-1

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
AZL-35002
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2024-24557 7.8
Record
BELL-CVE-2024-24557
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 6.9

Moby classic builder cache poisoning

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
CVE-2024-24557
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-345, CWE-346
Updated
2026-11-02
OSVDEBIAN-CVE-2024-24557 7.8

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
DEBIAN-CVE-2024-24557
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-xw73-rw38-6vjc 6.9

Classic builder cache poisoning

The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss.

An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.

For example, an attacker could create an image that is considered as a valid cache candidate for:

FROM scratch
MAINTAINER Pawel

when in fact the malicious image used as a cache would be an image built from a different Dockerfile.

In the second case, the attacker could for example substitute a different HEALTCHECK command.

Impact

23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint (which uses the classic builder by default).

All users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting.

Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default.

Patches

Patches are included in Moby releases:

  • v25.0.2
  • v24.0.9
  • v23.0.10

Workarounds

  • Use --no-cache or use Buildkit if possible (DOCKER_BUILDKIT=1, it's default on 23.0+ assuming that the buildx plugin is installed).
  • Use Version = types.BuilderBuildKit or NoCache = true in ImageBuildOptions for ImageBuild call.
Record
GHSA-xw73-rw38-6vjc
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Weakness
CWE-345, CWE-346
Updated
2026-11-02
OSVOESA-2024-1302 6.9

docker security update

Docker is an open source project to build, ship and run any application as a lightweight container.

Security Fix(es):

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.(CVE-2024-24557)

Record
OESA-2024-1302
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2024-24557 6.9

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

Record
UBUNTU-CVE-2024-24557
CVSS 3.1
6.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGO-2024-2512 No score

Classic builder cache poisoning in github.com/docker/docker

Classic builder cache poisoning in github.com/docker/docker

Record
GO-2024-2512
Updated
2026-11-02
OSVopenSUSE-SU-2024:14287-1 No score

forgejo-runner-3.5.1-1.1 on GA media

These are all security issues fixed in the forgejo-runner-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14287-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/docker/docker
Go
 25.0.0 up to 25.0.2
25.0.2
github.com/docker/docker
Go
 before 24.0.9
24.0.9
github.com/moby/moby
Go
 before 24.0.9
24.0.9
github.com/moby/moby
Go
 25.0.0 up to 25.0.2
25.0.2
docker
Alpine:v3.18
 before 25.0.2-r0
25.0.2-r0
docker
Alpine:v3.19
 before 25.0.2-r0
25.0.2-r0
docker
Alpine:v3.20
 before 25.0.2-r0
25.0.2-r0
docker
Alpine:v3.21
 before 25.0.2-r0
25.0.2-r0
docker
Alpine:v3.22
 before 25.0.2-r0
25.0.2-r0
docker
Alpine:v3.23
 before 25.0.2-r0
25.0.2-r0
Show 27 moreShow less
Affected packages
PackageAffectedFixed
docker
Alpine:v3.24
 before 25.0.2-r0
25.0.2-r0
moby-engine
Azure Linux:2
 before 20.10.27-3
20.10.27-3
moby-engine
Azure Linux:3
 before 25.0.3-1
25.0.3-1
docker
Alpaquita:23
 20.10.21-r1 and later None known
docker
Alpaquita:stream
 24.0.2-r0 up to 25.0.2-r0
25.0.2-r0
docker.io
Debian:12
 All versions, plus listed versions
20.10.24+dfsg1-120.10.24+dfsg1-1+deb12u120.10.25+dfsg1-120.10.25+dfsg1-220.10.25+dfsg1-3
Show 42 moreShow less
20.10.25+dfsg1-426.1.4+dfsg1-126.1.4+dfsg1-226.1.4+dfsg1-326.1.4+dfsg1-426.1.4+dfsg1-526.1.4+dfsg1-626.1.4+dfsg1-726.1.4+dfsg1-826.1.4+dfsg1-926.1.4+dfsg2-126.1.4+dfsg3-126.1.5+dfsg1-126.1.5+dfsg1-1026.1.5+dfsg1-226.1.5+dfsg1-326.1.5+dfsg1-426.1.5+dfsg1-526.1.5+dfsg1-626.1.5+dfsg1-726.1.5+dfsg1-826.1.5+dfsg1-927.5.1+dfsg1-127.5.1+dfsg1-227.5.1+dfsg2-127.5.1+dfsg3-127.5.1+dfsg3-227.5.1+dfsg3-327.5.1+dfsg3-427.5.1+dfsg3-527.5.1+dfsg3-627.5.1+dfsg4-127.5.1+dfsg4-228.5.2+dfsg1-128.5.2+dfsg2-128.5.2+dfsg3-128.5.2+dfsg3-228.5.2+dfsg4-128.5.2+dfsg4-228.5.2+dfsg4-328.5.2+dfsg4-428.5.2+dfsg4-5
 None known
docker.io
Debian:13
 before 26.1.4+dfsg1-9
26.1.4+dfsg1-9
docker.io
Debian:14
 before 26.1.4+dfsg1-9
26.1.4+dfsg1-9
github.com/docker/docker
Go
 before 24.0.9+incompatible, 25.0.0+incompatible up to 25.0.2+incompatible
24.0.9+incompatible25.0.2+incompatible
github.com/moby/moby
Go
 before 24.0.9+incompatible, 25.0.0+incompatible up to 25.0.2+incompatible
24.0.9+incompatible25.0.2+incompatible
docker
openEuler:20.03-LTS-SP1
 before engine-18.09.0-263.oe1
engine-18.09.0-263.oe1
docker
openEuler:20.03-LTS-SP4
 before engine-18.09.0-263.oe2003sp4
engine-18.09.0-263.oe2003sp4
docker
openEuler:22.03-LTS
 before engine-18.09.0-334.oe2203sp3
engine-18.09.0-334.oe2203sp3
docker
openEuler:22.03-LTS-SP1
 before engine-18.09.0-333.oe2203sp1
engine-18.09.0-333.oe2203sp1
docker
openEuler:22.03-LTS-SP2
 before engine-18.09.0-333.oe2203sp2
engine-18.09.0-333.oe2203sp2
docker
openEuler:22.03-LTS-SP3
 before engine-18.09.0-334.oe2203sp3
engine-18.09.0-334.oe2203sp3
docker.io
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.13.1-0ubuntu617.03.2-0ubuntu117.03.2-0ubuntu317.03.2-0ubuntu517.12.1-0ubuntu1
Show 22 moreShow less
18.06.1-0ubuntu1~18.04.118.06.1-0ubuntu1.2~18.04.118.09.2-0ubuntu1~18.04.118.09.5-0ubuntu1~18.04.218.09.7-0ubuntu1~18.04.118.09.7-0ubuntu1~18.04.318.09.7-0ubuntu1~18.04.419.03.6-0ubuntu1~18.04.119.03.6-0ubuntu1~18.04.219.03.6-0ubuntu1~18.04.320.10.2-0ubuntu1~18.04.220.10.2-0ubuntu1~18.04.320.10.7-0ubuntu1~18.04.120.10.7-0ubuntu1~18.04.220.10.7-0ubuntu5~18.04.220.10.7-0ubuntu5~18.04.320.10.12-0ubuntu2~18.04.120.10.21-0ubuntu1~18.04.220.10.21-0ubuntu1~18.04.320.10.21-0ubuntu1~18.04.3+esm120.10.21-0ubuntu1~18.04.3+esm220.10.21-0ubuntu1~18.04.3+esm3
 None known
docker.io
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
19.03.2-0ubuntu119.03.6-0ubuntu119.03.8-0ubuntu119.03.8-0ubuntu1.20.0419.03.8-0ubuntu1.20.04.1
Show 15 moreShow less
19.03.8-0ubuntu1.20.04.220.10.2-0ubuntu1~20.04.220.10.2-0ubuntu1~20.04.320.10.7-0ubuntu1~20.04.120.10.7-0ubuntu1~20.04.220.10.7-0ubuntu5~20.04.120.10.7-0ubuntu5~20.04.220.10.12-0ubuntu2~20.04.120.10.21-0ubuntu1~20.04.120.10.21-0ubuntu1~20.04.220.10.21-0ubuntu1~20.04.420.10.21-0ubuntu1~20.04.520.10.21-0ubuntu1~20.04.620.10.21-0ubuntu1~20.04.6+esm120.10.21-0ubuntu1~20.04.6+esm2
 None known
docker.io-app
Ubuntu:Pro:20.04:LTS
 before 26.1.3-0ubuntu1~20.04.1+esm1, plus listed versions
20.10.25-0ubuntu1~20.04.120.10.25-0ubuntu1~20.04.224.0.5-0ubuntu1~20.04.124.0.7-0ubuntu2~20.04.126.1.3-0ubuntu1~20.04.1
26.1.3-0ubuntu1~20.04.1+esm1
docker.io-app
Ubuntu:22.04:LTS
 before 27.5.1-0ubuntu3~22.04.2, plus listed versions
20.10.25-0ubuntu1~22.04.120.10.25-0ubuntu1~22.04.224.0.5-0ubuntu1~22.04.124.0.7-0ubuntu2~22.04.126.1.3-0ubuntu1~22.04.127.5.1-0ubuntu3~22.04.1
27.5.1-0ubuntu3~22.04.2
docker.io
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
20.10.7-0ubuntu520.10.7-0ubuntu720.10.12-0ubuntu120.10.12-0ubuntu220.10.12-0ubuntu3
Show 11 moreShow less
20.10.12-0ubuntu3+gke1.24.120.10.12-0ubuntu420.10.21-0ubuntu1~22.04.220.10.21-0ubuntu1~22.04.320.10.21-0ubuntu1~22.04.520.10.21-0ubuntu1~22.04.620.10.21-0ubuntu1~22.04.720.10.21-0ubuntu1~22.04.7+esm120.10.21-0ubuntu1~22.04.7+esm220.10.21-0ubuntu1~22.04.820.10.21-0ubuntu1~22.04.8+esm1
 None known
docker.io-app
Ubuntu:24.04:LTS
 before 27.5.1-0ubuntu3~24.04.2, plus listed versions
24.0.5-0ubuntu124.0.7-0ubuntu124.0.7-0ubuntu224.0.7-0ubuntu324.0.7-0ubuntu424.0.7-0ubuntu4.126.1.3-0ubuntu1~24.04.127.5.1-0ubuntu3~24.04.1
27.5.1-0ubuntu3~24.04.2
docker.io
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
20.10.24+dfsg1-1ubuntu220.10.25+dfsg1-2ubuntu120.10.25+dfsg1-2ubuntu1+esm120.10.25+dfsg1-2ubuntu1+esm220.10.25+dfsg1-2ubuntu1.24.04.120.10.25+dfsg1-2ubuntu1.24.04.1+esm1
 None known
docker.io
Ubuntu:25.10
 All versions, plus listed versions
26.1.5+dfsg1-9ubuntu1
 None known
docker.io
Ubuntu:26.10
 All versions, plus listed versions
27.5.1+dfsg4-2ubuntu128.5.2+dfsg4-5ubuntu1
 None known
docker.io
Ubuntu:26.04:LTS
 All versions, plus listed versions
26.1.5+dfsg1-9ubuntu127.5.1+dfsg4-1ubuntu127.5.1+dfsg4-2ubuntu1
 None known
forgejo-runner
openSUSE:Tumbleweed
 before 3.5.1-1.1
3.5.1-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-24557 is a medium vulnerability (CVSS 6.9) in Moby, published February 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in github.com/docker/docker 25.0.2.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open