CuraDevOps

tag: Moby · 2 items

Plan Moby v25.0.18 patches tar path-traversal CVE-2026-17106
2026-10-05 · Releases: moby · source ↗ #container-runtime#security#moby
  • Platform/SRE — Plan: CVE-2026-17106 allows a crafted tar archive to write outside the extraction directory in the Docker engine — real exposure for any host running Moby/Docker, but not KEV-listed and EPSS is 0.00 with no active exploitation evidence. Schedule an upgrade to v25.0.18 this sprint rather than treating it as an emergency.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: major release (25.0) · CVE-2026-17106 — CISA KEV: not listed, EPSS 0.00
Plan archived Docker Engine (Moby) v25.0.17 patches three container CVEs
2026-08-17 · Releases: moby · source ↗ #moby#container-security#cve
  • Platform/SRE — Plan: Three symlink/mount CVEs in the Docker engine (none KEV-listed, EPSS 0.00) warrant scheduling a patch to Moby 25.0.17 this sprint; also note that containerd 1.7 — vendored in this release — reaches EOL 2026-09-01, so any org running containerd 1.7 directly must plan a runtime upgrade within 15 days.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: containerd 1.7 reaches EOL in 15d (2026-09-01) · major release (25.0) · CVE-2024-40635 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-41567 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-41568 — CISA KEV: not listed, EPSS 0.00