moby vulnerabilities

CVEs per yearBy the year they were published

1. 20214
2. 20222
3. 20239
4. 20248
5. 20252
6. 202632

Newest CVEs

• CVE-2026-121520

  Malicious client could set xattr value outside of BuildKit state directory

  Moby · BuildKit

  Medium4.5
• CVE-2026-121522

  Possible panic from Git source resolver

  moby · BuildKit

  Medium6.7
• CVE-2026-61801

  github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

  moby · sys

  Medium5.5
• CVE-2026-92543

  Docker Engine insecure-registry fallback via malicious DNS responses

  Docker · Docker Engine

  High7.6
• CVE-2026-92542

  Blind VXLAN injection into encrypted overlay networks from cluster peer

  Docker · Docker Engine

  Medium6.9
• CVE-2026-93321

  Malformed LLB file operation can crash buildkitd

  moby · BuildKit

  Medium6.9
• CVE-2026-93315

  BuildKit proxy CA cleanup can be disrupted by build steps

  moby · BuildKit

  Medium5.8
• CVE-2026-93326

  Crafted Git build source can bypass certain policy validation

  moby · BuildKit

  Medium6.0
• CVE-2026-93323

  Oversized Dockerfile or .dockerignore can exhaust buildkitd memory

  moby · BuildKit

  Medium6.8
• CVE-2026-93322

  Malformed MergeOp can crash the BuildKit daemon

  moby · BuildKit

  Medium6.9