Description
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | docker.io | 26.1.4+dfsg1-9 | — |
| Debian 13 | docker.io | 26.1.4+dfsg1-9 | — |
| Debian 12 | docker.io | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | docker.io | No fix yet | — |
| Ubuntu 26.04 LTS | docker.io | No fix yet | — |
| Ubuntu 25.10 | docker.io | No fix yet | — |
| Ubuntu 24.04 LTS | docker.io-app | 27.5.1-0ubuntu3~24.04.2 | — |
| Ubuntu 22.04 LTS | docker.io-app | 27.5.1-0ubuntu3~22.04.2 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | docker.io | 20.10.25+dfsg1-2ubuntu1+esm2 | USN-7474-1 |
| Ubuntu Pro 22.04 LTS | docker.io | 20.10.21-0ubuntu1~22.04.7+esm2 | USN-7474-1 |
| Ubuntu Pro 20.04 LTS | docker.io | 20.10.21-0ubuntu1~20.04.6+esm2 | USN-7474-1 |
| Ubuntu Pro 20.04 LTS | docker.io-app | 26.1.3-0ubuntu1~20.04.1+esm1 | — |
| Ubuntu Pro 18.04 LTS | docker.io | 20.10.21-0ubuntu1~18.04.3+esm3 | USN-7474-1 |
| Ubuntu Pro 16.04 LTS | docker.io | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241209T183251-1.1 | openSUSE-SU-2024:14567-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | moby-engine | 25.0.3-9 | — |
| Azure Linux 2 (CBL-Mariner) | moby-engine | 24.0.9-13 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | docker-machine-driver-harvester | 1.0.4-r1 | — |
| Wolfi rolling | kubevela +3 | 1.9.13-r2 | — |
| Wolfi rolling | pulumi +3 | 3.142.0-r1 | — |
| Wolfi rolling | rancher-machine | 0.15.0.137-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/moby/moby | < 26.0.0 | 26.0.0 | GHSA-2mj3-vfvx-fc43 |
| Go | github.com/moby/moby | < 26.0.0+incompatible | 26.0.0+incompatible | GO-2024-3304 |
Advisories 2
- USN-7474-1 docker.io vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2024:14567-1 govulncheck-vulndb-0.0.20241209T183251-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026