Docker security updates

Security-fix and disclosure events for Docker. Targets recurring searches like “Docker security updates” with timeline evidence — not a marketing changelog.

53 timeline events on record.

Oct 13, 2026
Dockerfile: update to containerd v2.4.2
Dependency remediation
Dockerfile: update to containerd v2.4.2 Security Updates: - [CVE-2026-95839](https://github.com/containerd/containerd/security/advisories/GHSA-vwhp-8p66-mq4f) - [GHSA-8647-2jxj-p2rc](https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc) - [GHSA-hc94…
Open related record
Oct 13, 2026
vendor: github.com/containerd/containerd/v2 v2.4.2
Confirmed security fix
vendor: github.com/containerd/containerd/v2 v2.4.2 Security Updates: - [CVE-2026-95839](https://github.com/containerd/containerd/security/advisories/GHSA-vwhp-8p66-mq4f) - [GHSA-8647-2jxj-p2rc](https://github.com/containerd/containerd/security/advisories/GHSA-8647-2jxj-p2rc) -…
Open related record
Oct 8, 2026
Update to go1.26.9
Dependency remediation
Update to go1.26.9 These releases include 15 security fixes following the security policy: - net/http: HTTP/2 server crash due to HPACK encoder race HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the…
Open related record
Oct 5, 2026
vendor: github.com/cilium/ebpf v0.22.0
Confirmed security fix
vendor: github.com/cilium/ebpf v0.22.0 fix Kernel 7.1 compatibility In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest releas…
Open related record
Sep 25, 2026
Dockerfile: update to containerd v2.4.1
Dependency remediation
Dockerfile: update to containerd v2.4.1 includes a fix for CVE-2026-53493 / [GHSA-pg57-6jwg-q645] release-notes: https://github.com/containerd/containerd/releases/tag/v2.4.1 full diff: https://github.com/containerd/containerd/compare/v2.4.0...v2.4.1 [GHSA-pg57-6jwg-q645]: htt…
Open related record
Sep 25, 2026
vendor: github.com/containerd/containerd/v2 v2.4.1
Confirmed security fix
vendor: github.com/containerd/containerd/v2 v2.4.1 includes a fix for CVE-2026-53493 / [GHSA-pg57-6jwg-q645] release-notes: https://github.com/containerd/containerd/releases/tag/v2.4.1 full diff: https://github.com/containerd/containerd/compare/v2.4.0...v2.4.1 [GHSA-pg57-6jwg…
Open related record
Sep 5, 2026
Dockerfile: update to containerd v2.3.5
Dependency remediation
Dockerfile: update to containerd v2.3.5 Security Updates - [**CVE-2026-53495**](https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv) - [**GHSA-rp3h-jf77-q9p4**](https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4) rele…
Open related record
Sep 5, 2026
vendor: github.com/containerd/containerd/v2 v2.3.5
Confirmed security fix
vendor: github.com/containerd/containerd/v2 v2.3.5 full diff: https://github.com/containerd/containerd/compare/v2.3.4...v2.3.5 Security Updates - [**CVE-2026-53495**](https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv) - [**GHSA-rp3h-jf77-q9p4**]…
Open related record
Sep 2, 2026
vendor: golang.org/x/crypto v0.56.0
Confirmed security fix
vendor: golang.org/x/crypto v0.56.0 full diff: https://github.com/golang/crypto/compare/v0.55.0...v0.56.0 We have tagged version v0.56.0 of golang.org/x/crypto in order to address the following security issues: - ssh: prevent DoS on deadlocked established channel Previously,…
Open related record
Aug 13, 2026
vendor: golang.org/x/mod v0.40.0
Confirmed security fix
vendor: golang.org/x/mod v0.40.0 - x/mod/sumdb/tlog: fix transparency log tile verification bypass A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled modu…
Open related record
Aug 13, 2026
update to go1.26.6
Dependency remediation
update to go1.26.6 This release includes 10 security fixes following the security policy: - x/mod/sumdb/tlog: fix transparency log tile verification bypass A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypa…
Open related record
Jul 30, 2026
vendor: github.com/moby/go-archive v0.3.0
Dependency remediation
vendor: github.com/moby/go-archive v0.3.0 full diff: https://github.com/moby/go-archive/compare/v0.2.1...v0.3.0 v0.3.0 This release fixes CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h, where a crafted tar archive could use links to cause extraction operations to create or overwrite fi…
Open related record
Jul 7, 2026
update to go1.26.5
Dependency remediation
update to go1.26.5 go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls and os packages, as well as bug fixes to the compiler, the runtime, the go command, and the net, os, and syscall packages. See the Go 1.26.5 milestone on our issue tracker for details;…
Open related record
Jun 23, 2026
vendor: github.com/moby/sys/user v0.4.1
Dependency remediation
vendor: github.com/moby/sys/user v0.4.1 - user: prevent falling back to looking up numeric usernames Improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as [CVE-2026-46680] in containerd. - user: update minimum…
Open related record
Jun 19, 2026
Dockerfile: update containerd binary to v2.2.5
Dependency remediation
Dockerfile: update containerd binary to v2.2.5 - full diff: https://github.com/containerd/containerd/compare/v2.2.4...v2.2.5 - release notes: https://github.com/containerd/containerd/releases/tag/v2.2.5 The fifth patch release for containerd 2.2 contains various fixes and upda…
Open related record
Jun 19, 2026
vendor: github.com/containerd/containerd/v2 v2.2.5
Confirmed security fix
vendor: github.com/containerd/containerd/v2 v2.2.5 - full diff: https://github.com/containerd/containerd/compare/v2.2.4...v2.2.5 - release notes: https://github.com/containerd/containerd/releases/tag/v2.2.5 The fifth patch release for containerd 2.2 contains various fixes and…
Open related record
Jun 15, 2026
Dockerfile: update runc binary to v1.3.6
Dependency remediation
Dockerfile: update runc binary to v1.3.6 This is the sixth patch release of the 1.3.z series of runc. Among some performance improvements and bugfixes, it includes a fix for a low-severity vulnerability ([CVE-2026-41579]) and users are encouraged to update. As it was a low-seve…
Open related record
Jun 3, 2026
update to go1.26.4
Dependency remediation
update to go1.26.4 This release include 3 security fixes following the security policy: - mime: quadratic complexity in WordDecoder.DecodeHeader Decoding a maliciously-crafted MIME header containing many invalid encoded-words could consume excessive CPU. The MIME decoder n…
Open related record
May 22, 2026
vendor: golang.org/x/net v0.55.0
Confirmed security fix
vendor: golang.org/x/net v0.55.0 security changes (not used in our code) - html: escape greater-than symbol in doctype identifiers (CVE-2026-25681) - html: improve Noah's Ark clause performance (CVE-2026-25680) - html: properly render fostered elements in foreign content (CVE-…
Open related record
May 22, 2026
vendor: golang.org/x/crypto v0.52.0
Confirmed security fix
vendor: golang.org/x/crypto v0.52.0 changes: - ssh: fix deadlock on unexpected channel responses (CVE-2026-39830) - ssh: fix source-address critical option bypass (CVE-2026-46595) - ssh: fix incorrect operator order (CVE-2026-46597) - ssh: fix infinite loop on large channel wr…
Open related record
Feb 5, 2026
update to go1.25.7
Dependency remediation
update to go1.25.7 go1.25.7 (released 2026-02-04) includes security fixes to the go command and the crypto/tls package, as well as bug fixes to the compiler and the crypto/x509 package. See the Go 1.25.7 milestone on our issue tracker for details: https://github.com/golang/go/i…
Open related record
Jan 24, 2026
vendor: github.com/klauspost/compress v1.18.3
Confirmed security fix
vendor: github.com/klauspost/compress v1.18.3 no changes in vendored code - fixes / downstream CVE-2025-61728 full diff: https://github.com/klauspost/compress/compare/v1.18.2...v1.18.3
Open related record
Jan 16, 2026
update to go1.25.6
Dependency remediation
update to go1.25.6 This releases includes 6 security fixes following the security policy: - archive/zip: denial of service when parsing arbitrary ZIP archives archive/zip used a super-linear file name indexing algorithm that is invoked the first time a file in an archive is…
Open related record
Dec 12, 2025
vendor: github.com/containernetworking/plugins v1.9.0
Confirmed security fix
vendor: github.com/containernetworking/plugins v1.9.0 no changes in vendored code includes a fix for CVE-2025-67499 full diff: https://github.com/containernetworking/plugins/compare/v1.8.0...v1.9.0
Open related record
Dec 2, 2025
update to go1.25.5
Dependency remediation
update to go1.25.5 These releases include 2 security fixes following the security policy: - crypto/x509: excessive resource consumption in printing error string for host certificate validation Within HostnameError.Error(), when constructing an error string, there is no limit…
Open related record
Nov 26, 2025
vendor: golang.org/x/crypto v0.45.0
Confirmed security fix
vendor: golang.org/x/crypto v0.45.0 full diff: https://github.com/golang/crypto/compare/v0.44.0...v0.45.0 Hello gophers, We have tagged version v0.45.0 of golang.org/x/crypto in order to address two security issues. This version fixes a vulnerability in the golang.org/x/cryp…
Open related record
Nov 11, 2025
vendor: github.com/vbatts/tar-split v0.12.2
Confirmed security fix
vendor: github.com/vbatts/tar-split v0.12.2 - archive/tar: set a limit on the size of GNU sparse file 1.0 regions - fixes CVE-2025-58183 full diff: https://github.com/vbatts/tar-split/compare/v0.12.1...v0.12.2
Open related record
Nov 5, 2025
Dockerfile: update runc binary to v1.3.3
Dependency remediation
Dockerfile: update runc binary to v1.3.3 Update the version used in CI and for the static binaries. - release notes: https://github.com/opencontainers/runc/releases/tag/v1.3.3 - full diff: https://github.com/opencontainers/runc/compare/v1.3.2...v1.3.3 This release contains fi…
Open related record
Oct 8, 2025
vendor: golang.org/x/net v0.45.0
Confirmed security fix
vendor: golang.org/x/net v0.45.0 full diff: https://github.com/golang/net/compare/v0.44.0...v0.45.0 From the security announcement: [security] Vulnerabilities in golang.org/x/net Hello gophers, We have tagged version v0.45.0 of golang.org/x/net in order to address two secur…
Open related record
Oct 7, 2025
update to go1.24.8
Dependency remediation
update to go1.24.8 This minor release includes 10 security fixes following the security policy: - net/mail: excessive CPU consumption in ParseAddress The ParseAddress function constructed domain-literal address components through repeated string concatenation. When parsing l…
Open related record
Sep 3, 2025
update to go1.24.7
Dependency remediation
update to go1.24.7 This includes 1 security fix: - net/http: CrossOriginProtection bypass patterns are over-broad When passing patterns to CrossOriginProtection.AddInsecureBypassPattern, requests that would have redirected to those patterns (e.g. without a trailing slash)…
Open related record
Jul 8, 2025
update to go1.24.5
Dependency remediation
update to go1.24.5 - https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5 This minor releases include 1 security fixes following the security policy: - cmd/go: unexpected co…
Open related record
Jun 6, 2025
update to go1.24.4
Dependency remediation
update to go1.24.4 - https://github.com/golang/go/issues?q=milestone%3AGo1.24.4+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.3...go1.24.4 This release includes 3 security fixes following the security policy: - net/http: sensitive headers…
Open related record
Apr 17, 2025
vendor: golang.org/x/oauth2 v0.29.0
Confirmed security fix
vendor: golang.org/x/oauth2 v0.29.0 notable changes - oauth2.go: use a more straightforward return value - oauth2: Deep copy context client in NewClient - jws: improve fix for CVE-2025-22868 full diff: https://github.com/golang/oauth2/compare/v0.27.0...v0.29.0
Open related record
Apr 5, 2025
update to go1.23.8 (fix CVE-2025-22871)
Dependency remediation
Merge pull request #49737 from thaJeztah/bump_golang_1.23.8 update to go1.23.8 (fix CVE-2025-22871)
Open related record
Apr 3, 2025
update to go1.23.8 (fix CVE-2025-22871)
Dependency remediation
update to go1.23.8 (fix CVE-2025-22871) full diff: https://github.com/golang/go/compare/go1.23.7...go1.23.8 release notes: https://go.dev/doc/devel/release#go1.24.2 go1.23.8 (released 2025-04-01) includes security fixes to the net/http package, as well as bug fixes to the runt…
Open related record
Mar 23, 2025
vendor: github.com/golang-jwt/jwt/v5 v5.2.2
Confirmed security fix
vendor: github.com/golang-jwt/jwt/v5 v5.2.2 Fixes [GHSA-mh63-6h87-95cp] / [CVE-2025-30204] full diff: https://github.com/golang-jwt/jwt/compare/v5.2.1...v5.2.2 [GHSA-mh63-6h87-95cp]: https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp [CVE-2025-30204]: h…
Open related record
Mar 4, 2025
vendor: golang.org/x/net v0.36.0
Confirmed security fix
vendor: golang.org/x/net v0.36.0 full diff: https://github.com/golang/net/compare/v0.35.0...v0.36.0 Version v0.36.0 of golang.org/x/net fixes a vulnerability in the golang.org/x/net/proxy and golang.org/x/net/http/httpproxy packages which could cause the proxy to be bypassed.…
Open related record
Feb 25, 2025
vendor: golang.org/x/oauth2 v0.27.0
Confirmed security fix
vendor: golang.org/x/oauth2 v0.27.0 We have tagged version v0.27.0 of golang.org/x/oauth2 in order to address a security issue. jws: unexpected memory consumption during token parsing Version v0.27.0 of golang.org/x/oauth2 fixes a vulnerability in the golang.org/x/oauth2/jws…
Open related record
Jan 20, 2025
update to go1.23.5 (fix CVE-2024-45341, CVE-2024-45336)
Dependency remediation
Merge pull request #49311 from thaJeztah/bump_golang_1.23.5 update to go1.23.5 (fix CVE-2024-45341, CVE-2024-45336)
Open related record