[ Vendor · 13 CVEs ]
moby
CVEs affecting moby published in the last 30 days, plus any moby CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-61801 | 8 Oct 2026 | CVSS 5.5 | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesThe `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions… | Fix |
| CVE-2026-92542 | 7 Oct 2026 | CVSS 6.9 | Docker EngineThe firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged… | |
| CVE-2026-92543 | 7 Oct 2026 | CVSS 7.6 | Docker EngineDocker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as… | |
| CVE-2026-93315 | 5 Oct 2026 | CVSS 5.8 | moby BuildKitWhen proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside… | |
| CVE-2026-93321 | 5 Oct 2026 | CVSS 6.9 | moby BuildKitA malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. | |
| CVE-2026-93326 | 5 Oct 2026 | CVSS 6.0 | moby BuildKitA build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the… | |
| CVE-2026-93322 | 5 Oct 2026 | CVSS 6.9 | moby BuildKitA malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon. | |
| CVE-2026-93323 | 5 Oct 2026 | CVSS 6.8 | moby BuildKitThe Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing… | |
| CVE-2026-93318 | 5 Oct 2026 | CVSS 7.5 | moby BuildKitA malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the… | |
| CVE-2026-93319 | 5 Oct 2026 | CVSS 5.7 | moby BuildKitA malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the… | |
| CVE-2026-93320 | 5 Oct 2026 | CVSS 6.0 | moby BuildKitBuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations… | |
| CVE-2026-93316 | 5 Oct 2026 | CVSS 7.1 | moby BuildKitIf BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by… | |
| CVE-2026-93317 | 5 Oct 2026 | CVSS 5.9 | moby BuildKitAn unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The… |