Most recent entries from all

bdu:2026-07865

BELL-CVE-2026-34040

Affected: Alpaquita:stream: docker

certfr-2026-avi-0540 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu Gemfire. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-0540

Withdrawn: CLEANSTART-2026-AR38431 — Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-…

Withdrawn by the publisher.

Affected: CleanStart: vault

Multiple security vulnerabilities affect the vault package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-278631

fkie_cve-2026-34040

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

GHSA-x744-4wpc-v9h2 — Moby has AuthZ plugin bypass when provided oversized request bodies

Affected: Go: github.com/moby/moby, Go: github.com/moby/moby/v2

## Summary

A security vulnerability has been detected that allows attackers to bypass [authorization plugins (AuthZ)](https://docs.docker.com/engine/extend/plugins_authorization/) under specific circumstances. The base likelihood of this being exploited is low.

This is an incomplete fix for [CVE-2024-41110](https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq).

## Impact

**If you don't use AuthZ plugins, you are not affected.**

Using a specially-crafted API request, an attacker could make the Docker daemon forward the request to an authorization plugin without the body. The authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

Anyone who depends on authorization plugins that introspect the request body to make access control decisions is potentially impacted.

## Workarounds

If unable to update immediately: - Avoid using AuthZ plugins that rely on request body inspection for security decisions. - Restrict access to the Docker API to trusted parties, following the principle of least privilege.

## Credits

- 1seal / Oleh Konko ([@1seal](https://github.com/1seal)) - Cody (c@wormhole.guru) - Asim Viladi Oglu Manizada (@manizada)

## Resources

- [CVE-2024-41110 / GHSA-v23v-6jw2-98fq](https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq)

OESA-2026-1888 — docker security update

Affected: openEuler:24.03-LTS-SP1: docker, openEuler:24.03-LTS-SP2: docker, openEuler:24.03-LTS-SP3: docker, openEuler:20.03-LTS-SP4: docker, openEuler:22.03-LTS-SP4: docker, openEuler:24.03-LTS: docker

Docker is a product for you to build, ship and run any application as a lightweight container. Security Fix(es):

openSUSE-SU-2026:11075-1 — docker-stable-24.0.9_ce-18.1 on GA media

docker-stable-24.0.9_ce-18.1 on GA media

RHSA-2026:21769 — Red Hat Security Advisory: Multicluster Global Hub 1.5.4 security update

grafana/tempo: Tempo: Denial of Service via large queries net/url: Incorrect parsing of IPv6 host literals in net/url crypto/x509: Incorrect enforcement of email constraints in crypto/x509 github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via mal…

SUSE-SU-2026:2578-1 — Security update for docker-stable

Security update for docker-stable

UBUNTU-CVE-2026-34040

Affected: Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:Pro:18.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io-app, Ubuntu:Pro:22.04:LTS: docker.io, Ubuntu:Pro:22.04:LTS: docker.io-app, Ubuntu:Pro:24.04:LTS: docker.io, Ubuntu:Pro:24.04:LTS: docker.io-app, Ubuntu:25.10: docker.io, Ubuntu:25.10: docker.io-app and 2 more

WID-SEC-W-2026-0873 — docker: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in docker ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.