Docker security fix timeline
Public commits from moby/moby whose messages cite a vulnerability or a security fix. Patch text is not stored.
53 security-fix timeline events
Sep 3, 2025 · CVE-2025-47910
update to go1.24.7
update to go1.24.7 This includes 1 security fix: - net/http: CrossOriginProtection bypass patterns are over-broad When passing patterns to CrossOriginProtection.AddInsecureBypassPattern, requests that would have redirected to those patterns (e.g. without a trailing…
Jul 8, 2025 · CVE-2025-4674
update to go1.24.5
update to go1.24.5 - https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5 This minor releases include 1 security fixes following the security policy: - cmd/go: unexpected co…
Jun 6, 2025 · CVE-2025-4673
update to go1.24.4
update to go1.24.4 - https://github.com/golang/go/issues?q=milestone%3AGo1.24.4+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.3...go1.24.4 This release includes 3 security fixes following the security policy: - net/http: sensitive headers…
Apr 17, 2025 · CVE-2025-22868
vendor: golang.org/x/oauth2 v0.29.0
vendor: golang.org/x/oauth2 v0.29.0 notable changes - oauth2.go: use a more straightforward return value - oauth2: Deep copy context client in NewClient - jws: improve fix for CVE-2025-22868 full diff: https://github.com/golang/oauth2/compare/v0.27.0...v0.29.0
Apr 5, 2025 · CVE-2025-22871
update to go1.23.8 (fix CVE-2025-22871)
Merge pull request #49737 from thaJeztah/bump_golang_1.23.8 update to go1.23.8 (fix CVE-2025-22871)
Apr 3, 2025 · CVE-2025-22871
update to go1.23.8 (fix CVE-2025-22871)
update to go1.23.8 (fix CVE-2025-22871) full diff: https://github.com/golang/go/compare/go1.23.7...go1.23.8 release notes: https://go.dev/doc/devel/release#go1.24.2 go1.23.8 (released 2025-04-01) includes security fixes to the net/http package, as well as bug fixes to the runt…
Mar 23, 2025 · CVE-2025-30204
vendor: github.com/golang-jwt/jwt/v5 v5.2.2
vendor: github.com/golang-jwt/jwt/v5 v5.2.2 Fixes [GHSA-mh63-6h87-95cp] / [CVE-2025-30204] full diff: https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2 [GHSA-mh63-6h87-95cp]: https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp [CVE-2025-30204]: h…
Mar 4, 2025 · CVE-2025-22870
vendor: golang.org/x/net v0.36.0
vendor: golang.org/x/net v0.36.0 full diff: https://github.com/golang/net/compare/v0.35.0...v0.36.0 Version v0.36.0 of golang.org/x/net fixes a vulnerability in the golang.org/x/net/proxy and golang.org/x/net/http/httpproxy packages which could cause the proxy to be bypassed.…
Feb 25, 2025 · CVE-2025-22868
vendor: golang.org/x/oauth2 v0.27.0
vendor: golang.org/x/oauth2 v0.27.0 We have tagged version v0.27.0 of golang.org/x/oauth2 in order to address a security issue. jws: unexpected memory consumption during token parsing Version v0.27.0 of golang.org/x/oauth2 fixes a vulnerability in the golang.org/x/oauth2/jws…
Jan 20, 2025 · CVE-2024-45341
update to go1.23.5 (fix CVE-2024-45341, CVE-2024-45336)
Merge pull request #49311 from thaJeztah/bump_golang_1.23.5 update to go1.23.5 (fix CVE-2024-45341, CVE-2024-45336)