Skip to content
OpenAdvisories

Product · Docker

Docker Engine

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.6
    CVE-2026-92543

    Docker Engine insecure-registry fallback via malicious DNS responses

    Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single add…

    Docker moby moby Docker Engine Debian Ubuntu Alpine
  • High 7.1
    CVE-2026-17106 Public exploit

    Tar extraction in moby/go-archive can write outside the destination directory via link following

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical str…

    Docker moby Docker Desktop Docker Sandboxes Debian Ubuntu Go