Docker security fix timeline
Public commits from moby/moby whose messages cite a vulnerability or a security fix. Patch text is not stored.
53 security-fix timeline events
Feb 5, 2026 · CVE-2025-61732
update to go1.25.7
update to go1.25.7 go1.25.7 (released 2026-02-04) includes security fixes to the go command and the crypto/tls package, as well as bug fixes to the compiler and the crypto/x509 package. See the Go 1.25.7 milestone on our issue tracker for details: https://github.com/golang/go/i…
Jan 24, 2026 · CVE-2025-61728
vendor: github.com/klauspost/compress v1.18.3
vendor: github.com/klauspost/compress v1.18.3 no changes in vendored code - fixes / downstream CVE-2025-61728 full diff: https://github.com/klauspost/compress/compare/v1.18.2...v1.18.3
Jan 16, 2026 · CVE-2025-61728
update to go1.25.6
update to go1.25.6 This releases includes 6 security fixes following the security policy: - archive/zip: denial of service when parsing arbitrary ZIP archives archive/zip used a super-linear file name indexing algorithm that is invoked the first time a file in an archive…
Dec 12, 2025 · CVE-2025-67499
vendor: github.com/containernetworking/plugins v1.9.0
vendor: github.com/containernetworking/plugins v1.9.0 no changes in vendored code includes a fix for CVE-2025-67499 full diff: https://github.com/containernetworking/plugins/compare/v1.8.0...v1.9.0
Dec 2, 2025 · CVE-2025-61729
update to go1.25.5
update to go1.25.5 These releases include 2 security fixes following the security policy: - crypto/x509: excessive resource consumption in printing error string for host certificate validation Within HostnameError.Error(), when constructing an error string, there is no li…
Nov 26, 2025 · CVE-2025-58181
vendor: golang.org/x/crypto v0.45.0
vendor: golang.org/x/crypto v0.45.0 full diff: https://github.com/golang/crypto/compare/v0.44.0...v0.45.0 Hello gophers, We have tagged version v0.45.0 of golang.org/x/crypto in order to address two security issues. This version fixes a vulnerability in the golang.org/x/cryp…
Nov 11, 2025 · CVE-2025-58183
vendor: github.com/vbatts/tar-split v0.12.2
vendor: github.com/vbatts/tar-split v0.12.2 - archive/tar: set a limit on the size of GNU sparse file 1.0 regions - fixes CVE-2025-58183 full diff: https://github.com/vbatts/tar-split/compare/v0.12.1...v0.12.2
Nov 5, 2025 · CVE-2025-31133
Dockerfile: update runc binary to v1.3.3
Dockerfile: update runc binary to v1.3.3 Update the version used in CI and for the static binaries. - release notes: https://github.com/opencontainers/runc/releases/tag/v1.3.3 - full diff: https://github.com/opencontainers/runc/compare/v1.3.2...v1.3.3 This release contains fi…
Oct 8, 2025 · CVE-2025-47911
vendor: golang.org/x/net v0.45.0
vendor: golang.org/x/net v0.45.0 full diff: https://github.com/golang/net/compare/v0.44.0...v0.45.0 From the security announcement: [security] Vulnerabilities in golang.org/x/net Hello gophers, We have tagged version v0.45.0 of golang.org/x/net in order to address two secur…
Oct 7, 2025 · CVE-2025-61725
update to go1.24.8
update to go1.24.8 This minor release includes 10 security fixes following the security policy: - net/mail: excessive CPU consumption in ParseAddress The ParseAddress function constructed domain-literal address components through repeated string concatenation. When parsin…