Docker security fix timeline
Public commits from moby/moby whose messages cite a vulnerability or a security fix. Patch text is not stored.
53 security-fix timeline events
Aug 13, 2026 · CVE-2026-56865
update to go1.26.6
update to go1.26.6 This release includes 10 security fixes following the security policy: - x/mod/sumdb/tlog: fix transparency log tile verification bypass A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module…
Jul 30, 2026 · CVE-2026-17106
vendor: github.com/moby/go-archive v0.3.0
vendor: github.com/moby/go-archive v0.3.0 full diff: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0 v0.3.0 This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite fi…
Jul 7, 2026 · CVE-2026-39822
update to go1.26.5
update to go1.26.5 go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages. See the Go 1.26.5 milestone on our issue tracker for details;…
Jun 23, 2026 · CVE-2026-46680
vendor: github.com/moby/sys/user v0.4.1
vendor: github.com/moby/sys/user v0.4.1 - user: prevent falling back to looking up numeric usernames Improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as [CVE-2026-46680] in containerd. - user: update mini…
Jun 19, 2026 · CVE-2026-50195
Dockerfile: update containerd binary to v2.2.5
Dockerfile: update containerd binary to v2.2.5 - full diff: https://github.com/containerd/containerd/compare/v2.2.4...v2.2.5 - release notes: https://github.com/containerd/containerd/releases/tag/v2.2.5 The fifth patch release for containerd 2.2 contains various fixes and upda…
Jun 19, 2026 · CVE-2026-50195
vendor: github.com/containerd/containerd/v2 v2.2.5
vendor: github.com/containerd/containerd/v2 v2.2.5 - full diff: https://github.com/containerd/containerd/compare/v2.2.4...v2.2.5 - release notes: https://github.com/containerd/containerd/releases/tag/v2.2.5 The fifth patch release for containerd 2.2 contains various fixes and…
Jun 15, 2026 · CVE-2026-41579
Dockerfile: update runc binary to v1.3.6
Dockerfile: update runc binary to v1.3.6 This is the sixth patch release of the 1.3.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ([CVE-2026-41579]) and users are encouraged to update. As it was a low-seve…
Jun 3, 2026 · CVE-2026-42504
update to go1.26.4
update to go1.26.4 This release include 3 security fixes following the security policy: - mime: quadratic complexity in WordDecoder.DecodeHeader Decoding a maliciously-crafted MIME header containing many invalid encoded-words could consume excessive CPU. The MIME…
May 22, 2026 · CVE-2026-25681
vendor: golang.org/x/net v0.55.0
vendor: golang.org/x/net v0.55.0 security changes (not used in our code) - html: escape greater-than symbol in doctype identifiers (CVE-2026-25681) - html: improve Noah's Ark clause performance (CVE-2026-25680) - html: properly render fostered elements in foreign content (CVE-…
May 22, 2026 · CVE-2026-39830
vendor: golang.org/x/crypto v0.52.0
vendor: golang.org/x/crypto v0.52.0 changes: - ssh: fix deadlock on unexpected channel responses (CVE-2026-39830) - ssh: fix source-address critical option bypass (CVE-2026-46595) - ssh: fix incorrect operator order (CVE-2026-46597) - ssh: fix infinite loop on large channel wr…