Moby vulnerabilities

Products

• Buildkit 26
• Moby 20
• Hyperkit 5

Newest

• moby buildkit Malformed LLB file operation can crash buildkitd CVE-2026-93321 Fix available 6.9 MediumOctober 5, 2026
• moby buildkit BuildKit proxy CA cleanup can be disrupted by build steps CVE-2026-93315 Fix available 5.8 MediumOctober 5, 2026
• moby buildkit Crafted Git build source can bypass certain policy validation CVE-2026-93326 Fix available 6.0 MediumOctober 5, 2026
• moby buildkit Oversized Dockerfile or .dockerignore can exhaust buildkitd memory CVE-2026-93323 Fix available 6.8 MediumOctober 5, 2026
• moby buildkit Malformed MergeOp can crash the BuildKit daemon CVE-2026-93322 6.9 MediumOctober 5, 2026
• moby buildkit BuildKit improperly handles special files in build snapshots CVE-2026-93320 6.0 MediumOctober 5, 2026
• moby buildkit A malicious frontend can cause a daemon panic CVE-2026-93319 5.7 MediumOctober 5, 2026
• moby buildkit Cache poisoning via unvalidated image layer DiffIDs CVE-2026-93318 7.5 HighOctober 5, 2026
• moby buildkit Container blob cache can accept unverified content CVE-2026-93317 5.9 MediumOctober 5, 2026
• moby buildkit Starting daemon with --cdi-disabled flag can lead to panic on specific builds CVE-2026-93316 7.1 HighOctober 5, 2026
• moby buildkit BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter CVE-2026-94298 6.2 MediumOctober 2, 2026
• docker engine, engine overlay network driver, moby overlay network driver +2 more Blind VXLAN injection into encrypted overlay networks from cluster peer CVE-2026-92542 Fix available 6.9 MediumOctober 1, 2026
• docker engine, moby +1 more Docker Engine insecure-registry fallback via malicious DNS responses CVE-2026-92543 Fix available 7.6 HighOctober 1, 2026
• moby buildkit BuildKit: Custom frontend could bypass Seccomp/AppArmor CVE-2026-61711 Fix available 5.3 MediumAugust 19, 2026
• moby go-archive, docker cli, compose +3 more +5 more Tar extraction in moby/go-archive can write outside the destination directory via link following CVE-2026-17106 Public exploitFix available 7.1 HighAugust 18, 2026
• moby sys github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files CVE-2026-61801 Fix available 5.5 MediumAugust 3, 2026
• moby buildkit BuildKit: Possible runtime DoS via unbounded group parsing CVE-2026-61712 Fix available 2.3 LowAugust 3, 2026
• moby buildkit Possible panic when incorrect parameters sent from frontend CVE-2026-15792 Fix available 6.3 MediumJuly 21, 2026
• moby buildkit BuildKit: Malicious client can bypass destination directory validation on local sources upload CVE-2026-75593 Fix available 7.2 HighJuly 21, 2026
• moby buildkit LLB file operation can be tricked to remove /tmp directory contents CVE-2026-15791 3.3 LowJuly 21, 2026
• moby buildkit Malicious client can bypass destination directory validation on local sources upload CVE-2026-15789 Fix available 6.9 MediumJuly 21, 2026
• moby buildkit Git source checkout from a bundle file could lead to command injection CVE-2026-15793 6.5 MediumJuly 21, 2026
• moby buildkit WCOW cache mount source selector resolves NTFS junctions outside of cache root CVE-2026-15788 Fix available 5.6 MediumJuly 20, 2026
• docker engine, moby, mobyproject moby\/v2 +2 more Moby: Race condition in docker cp allows bind mount redirection to host path CVE-2026-42306 Fix available 7.2 HighMay 18, 2026
• docker engine, moby, mobyproject moby\/v2 +2 more Moby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap CVE-2026-41568 Fix available 6.1 MediumMay 18, 2026
• docker engine, moby docker engine, docker docker/daemon +20 more +22 more Docker: `PUT /containers/{id}/archive` executes container binary on the host CVE-2026-41567 Public exploitFix available 7.2 HighMay 18, 2026
• moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 more SpdyStream: DOS on CRI CVE-2026-35469 Fix available 8.7 HighApril 16, 2026
• moby, docker engine +1 more Moby: AuthZ plugin bypass with oversized request body CVE-2026-34040 Public exploitFix available 8.8 HighMarch 27, 2026
• moby, docker engine, red hat multicluster engine for kubernetes +7 more +9 more Moby: Off-by-one error in plugin privilege validation CVE-2026-33997 Fix available 6.8 MediumMarch 27, 2026
• moby buildkit BuildKit Git URL subdir component can cause access to restricted files CVE-2026-33748 Fix available 8.2 HighMarch 26, 2026
• moby buildkit BuildKit vulnerable to malicious frontend causing file escape outside of storage root CVE-2026-33747 Fix available 8.4 HighMarch 26, 2026
• moby Moby's Firewalld reload removes bridge network isolation CVE-2025-54410 Fix available 3.3 LowJuly 29, 2025
• moby Moby's Firewalld reload makes published container ports accessible from remote hosts CVE-2025-54388 Fix available 5.1 MediumJuly 29, 2025
• docker moby Moby authz zero length regression CVE-2024-41110 Public exploitFix available EPSS 16.5% 10.0 CriticalJuly 24, 2024
• moby Moby IPv6 enabled on IPv4-only network interfaces CVE-2024-32473 Fix available 4.7 MediumApril 18, 2024
• moby External DNS requests from 'internal' networks could lead to data exfiltration CVE-2024-29018 Fix available 5.9 MediumMarch 20, 2024
• moby Moby classic builder cache poisoning CVE-2024-24557 Fix available 6.9 MediumFebruary 1, 2024
• moby buildkit BuildKit interactive containers API does not validate entitlements check CVE-2024-23653 Public exploitFix available 9.8 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible host system access from mount stub cleaner CVE-2024-23652 Public exploitFix available 10.0 CriticalJanuary 31, 2024
• moby buildkit BuildKit possible race condition with accessing subpaths from cache mounts CVE-2024-23651 Fix available 8.7 HighJanuary 31, 2024
• moby buildkit BuildKit possible panic when incorrect parameters sent from frontend CVE-2024-23650 Fix available 5.3 MediumJanuary 31, 2024
• moby moby/moby's dockerd daemon encrypted overlay network may be unauthenticated CVE-2023-28840 Fix available 7.5 HighApril 4, 2023
• moby moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted CVE-2023-28841 Fix available 6.8 MediumApril 4, 2023
• moby moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated CVE-2023-28842 Fix available 6.8 MediumApril 4, 2023
• moby buildkit Credentials inlined to Git URLs could end up in provenance attestation in BuildKit CVE-2023-26054 Fix available 6.5 MediumMarch 6, 2023
• moby hyperkit Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVE-2021-32847 7.1 HighFebruary 20, 2023
• moby hyperkit Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVE-2021-32846 7.7 HighFebruary 17, 2023
• moby hyperkit Moby HyperKit uninitialized memory use vtrnd pci_vtrnd_notify CVE-2021-32845 7.7 HighFebruary 17, 2023
• moby hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0... CVE-2021-32844 6.2 MediumFebruary 17, 2023
• moby hyperkit HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0... CVE-2021-32843 6.2 MediumFebruary 17, 2023
• Show olderLoading…