github.com/docker/docker (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/docker/docker, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (35)

• CVE-2014-9357 — CVSS 10.0 (critical): Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in…
• CVE-2024-41110 — CVSS 9.9 (critical): Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain…
• CVE-2019-14271 — CVSS 9.8 (critical): In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility…
• CVE-2026-34040 — CVSS 8.8 (high): Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to…
• CVE-2014-9356 — CVSS 8.6 (high): Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection…
• CVE-2015-3629 — CVSS 7.8 (high): Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to…
• CVE-2014-6407 — CVSS 7.5 (high): Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link…
• CVE-2023-28840 — CVSS 7.5 (high): Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various…
• CVE-2018-12608 — CVSS 7.5 (high): An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both the configured…
• CVE-2019-13509 — CVSS 7.5 (high): In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode…
• CVE-2014-3499 — CVSS 7.2 (high): Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via…
• CVE-2015-3627 — CVSS 7.2 (high): Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which…
• CVE-2015-3630 — CVSS 7.2 (high): Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs…
• CVE-2026-41567 — CVSS 7.2 (high): Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed…
• CVE-2026-42306 — CVSS 7.2 (high): Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby…
• CVE-2024-24557 — CVSS 6.9 (medium): Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache…
• CVE-2026-33997 — CVSS 6.8 (medium): Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins…
• CVE-2023-28842 — CVSS 6.8 (medium): Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various…
• CVE-2023-28841 — CVSS 6.8 (medium): Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various…
• CVE-2014-9358 — CVSS 6.4 (medium): Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof…
• CVE-2021-41091 — CVSS 6.3 (medium): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the…
• CVE-2026-41568 — CVSS 6.1 (medium): Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby…
• CVE-2024-29018 — CVSS 5.9 (medium): Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container…
• CVE-2022-24769 — CVSS 5.9 (medium): Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker…
• CVE-2020-27534 — CVSS 5.3 (medium): util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary…
• CVE-2022-36109 — CVSS 5.3 (medium): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where…
• CVE-2023-25173 — CVSS 5.3 (medium): containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary…
• CVE-2014-6408 — CVSS 5.0 (medium): Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container…
• CVE-2014-5277 — CVSS 5.0 (medium): Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows…
• CVE-2024-32473 — CVSS 4.7 (medium): Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container…
• CVE-2025-54388 — CVSS 4.6 (medium): Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and…
• CVE-2015-3631 — CVSS 3.6 (low): Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows…
• CVE-2025-54410 — CVSS 3.3 (low): Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and…
• CVE-2021-41190 — CVSS 3.0 (low): The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI…
• CVE-2021-41089 — CVSS 2.8 (low): Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where…