Skip to content
OpenAdvisories

Package · Wolfi

buildah

88 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.1
    CVE-2026-17106 Public exploit

    Tar extraction in moby/go-archive can write outside the destination directory via link following

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical str…

    Docker moby Docker Desktop Docker Sandboxes Debian Ubuntu Azure Linux Wolfi Go
  • High 7.2
    CVE-2026-41567 Public exploit

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…

    Docker moby moby/v2/daemon docker/daemon Debian Ubuntu Alpine Wolfi Go
  • High 8.8
    CVE-2026-34040 Public exploit

    Moby: AuthZ plugin bypass with oversized request body

    Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

    moby moby zot kots Debian Ubuntu Alpine Wolfi Go
  • High 7.3
    CVE-2025-52881 Public exploit

    runc: LSM labels can be bypassed with malicious config using dummy procfs files

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with s…

    opencontainers runc zot kubescape Debian Ubuntu Azure Linux Alpine Wolfi Go
  • High 7.3
    CVE-2025-31133 Public exploit

    runc container escape via "masked path" abuse due to mount race conditions

    runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount…

    opencontainers runc k3s-static-1.32 falco-no-driver Debian Ubuntu Azure Linux Alpine Wolfi Go