Plan
active
Moby v29.9.0 patches multiple HTTP/2 DoS CVEs in Docker Engine
- Platform/SRE — Plan: Four HTTP/2 CVEs in the Docker daemon (daemon crash, memory exhaustion, flow-control bypass, CPU spike) are fixed in this release; none are KEV-listed and EPSS scores are near zero, so no active exploitation clock, but schedule an upgrade to v29.9.0 if running Docker Engine on cluster nodes or VM fleets.
- CI/CD — Plan: If Docker-in-Docker or a Docker socket is part of your build runners, the same HTTP/2 daemon vulnerabilities apply; plan to update the Docker Engine version in runner images or host provisioning to v29.9.0, no hard deadline but meaningful DoS risk in shared build infrastructure.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found) · CVE-2026-56857 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-78659 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78663 — CISA KEV: not listed, EPSS 0.01
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.