VersionDrift
Product

Docker Engine

Containers · products/docker-engine.yaml · RSS

Latest 29.9.2 Oct 20, 2026

Lifecycle

BranchLatestReleasedEnd of life
2929.9.2Nov 10, 2025— · maintained
2828.5.2Feb 20, 2025May 13, 2026 · ended
2727.5.1Jun 25, 2024May 3, 2025 · ended
26.126.1.5Apr 22, 2024Feb 17, 2025 · ended
26.026.0.2Mar 20, 2024Jun 8, 2024 · ended
25.025.0.18Jan 19, 2024Dec 4, 2026 · maintained
24.024.0.9May 16, 2023Jun 8, 2024 · ended
23.023.0.18Feb 2, 2023May 19, 2025 · ended
20.1020.10.27Dec 9, 2020Dec 10, 2023 · ended
19.0319.03.15Jul 22, 2019Jan 8, 2021 · ended
18.0918.09.9Nov 8, 2018Aug 22, 2019 · ended
18.0618.06.3Jul 18, 2018Dec 8, 2018 · ended
18.0518.05.0Apr 25, 2018Aug 18, 2018 · ended
18.0418.04.0Mar 27, 2018Jun 9, 2018 · ended
18.0318.03.1Mar 14, 2018May 10, 2018 · ended
18.0218.02.0Jan 26, 2018Apr 21, 2018 · ended
17.1217.12.1Dec 15, 2017Feb 10, 2018 · ended
18.0118.01.0Dec 12, 2017Mar 7, 2018 · ended
17.1117.11.0Nov 17, 2017Jan 27, 2018 · ended
17.1017.10.0Oct 13, 2017Dec 20, 2017 · ended
17.0917.09.1Sep 22, 2017Nov 17, 2017 · ended
17.0717.07.0Aug 28, 2017Oct 26, 2017 · ended
17.0617.06.2Jun 20, 2017Sep 29, 2017 · ended
17.0517.05.0May 4, 2017Jul 28, 2017 · ended
17.0417.04.0Apr 3, 2017Jun 4, 2017 · ended
17.0317.03.2Feb 23, 2017May 5, 2017 · ended

Recent releases

29.9.2 Oct 20, 2026 Release notes ↗ 5security
securityThe Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected…
securityDomain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C
securityOrganization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C
29.9.1 Oct 14, 2026 → 29.9.2 Release notes ↗ 3security9fix1feature
securityCVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest.
securityGHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer.
securityGHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation.
29.9.0 Oct 8, 2026 → 29.9.2 Release notes ↗ 6security12fix2feature
securityCVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867
securityCVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857
securityCVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743
29.8.2 Sep 30, 2026 → 29.9.2 Release notes ↗ 13security2fix
securityCVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645
securityCVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73
securityCVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh
29.8.1 Sep 15, 2026 → 29.9.2 Release notes ↗ 5fix
29.8.0 Sep 3, 2026 → 29.9.2 Release notes ↗ 3feature2security23fix
securityAdd daemon support for configuring the default container AppArmor profile template. moby/moby#52771
securityPrevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551
29.7.2 Aug 6, 2026 → 29.9.2 Release notes ↗ 3fix
29.7.1 Jul 31, 2026 → 29.9.2 Release notes ↗ 2fix
29.7.0 Jul 30, 2026 → 29.9.2 Release notes ↗ 3feature1security15fix
securityUpdate github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106 / GHSA-hfg8-hc9c-6c3h. moby/moby#53247, docker/cli#7139
29.6.2 Jul 16, 2026 → 29.9.2 Release notes ↗ 5security
securityCVE-2026-15793: Git source checkout from a bundle file could lead to command injection. GHSA-hw3h-2gp9-cxpv
securityCVE-2026-15792: Incorrect parameters sent from a frontend could cause a panic. GHSA-qx3x-mv6r-52p6
securityCVE-2026-15791: An LLB file operation could be tricked into removing the contents of the /tmp directory. GHSA-32pv-7hq5-qhwq
29.6.1 Jun 26, 2026 → 29.9.2 Release notes ↗ 2security1fix
securityA malicious image could supply a malicious /etc/passwd or /etc/group-style file causing excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions. GHSA-mjcv-p78q-w5fw, GHSA-jpcc-p29g-p8mq, GHSA-72x6-4j93-7w86
securityA custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers.…
29.6.0 Jun 18, 2026 → 29.9.2 Release notes ↗ 3feature10fix1deprecated
29.5.3 Jun 3, 2026 → 29.9.2 Release notes ↗ 3fix
29.5.2 May 20, 2026 → 29.9.2 Release notes ↗ 1fix
29.5.1 May 18, 2026 → 29.9.2 Release notes ↗ 3security1fix
securityCVE-2026-41567 Fix a vulnerability in docker cp where archive decompression binaries (e.g. xz, unpigz) were resolved via PATH inside the container filesystem while running as host root, allowing a malicious container to execute arbitrary binaries with host root privileges. GHSA-x86f-5xw2-fm2r
securityCVE-2026-41568 Fix a TOCTOU vulnerability in docker cp that allowed a container process to create files or directories at arbitrary locations on the host filesystem. GHSA-vp62-88p7-qqf5
securityCVE-2026-42306 Fix a TOCTOU vulnerability in docker cp that allowed a container process to redirect a bind mount to an arbitrary location on the host filesystem. GHSA-rg2x-37c3-w2rh

Security advisories

7.6 CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses
6.9 CVE-2026-92542 Blind VXLAN injection into encrypted overlay networks from cluster peer
7.2 CVE-2026-42306 Race condition in docker cp allows bind mount redirection to host path
6.1 CVE-2026-41568 Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
7.2 CVE-2026-41567 `PUT /containers/{id}/archive` executes container binary on the host
8.8 CVE-2026-34040 AuthZ plugin bypass with oversized request body
6.8 CVE-2026-33997 Off-by-one error in plugin privilege validation
5.1 CVE-2025-54388 Firewalld reload makes published container ports accessible from remote hosts
3.3 CVE-2025-54410 Firewalld reload removes bridge network isolation
9.9 CVE-2024-41110 Authz zero length regression
medium CVE-2024-32473 IPv6 enabled on IPv4-only network interfaces
5.9 CVE-2024-29018 External DNS requests from 'internal' networks could lead to data exfiltration
6.9 CVE-2024-24557 Classic builder cache poisoning
medium GHSA-jq35-85cj-fj4p /sys/devices/virtual/powercap accessible by default to containers
high GHSA-vwm3-crmr-xfxw The Swarm VXLAN port may be exposed to attack due to ambiguous documentation
6.8 CVE-2023-28842 Encrypted overlay network with a single endpoint is unauthenticated
6.8 CVE-2023-28841 Encrypted overlay network traffic may be unencrypted
7.5 CVE-2023-28840 Encrypted overlay network may be unauthenticated
low GHSA-vp35-85q5-9f25 Container build can leak any path on the host into the container (using Git CVE-2022-39253)
low CVE-2022-36109 Security vulnerability relating to supplementary group permissions

Sources

See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status