Docker Engine 29.7.1 → 29.9.2

Vulnerabilities fixed by this upgrade

• 7.6 CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses

Breaking changes

None in the release notes.

Security changes

• security The Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected… in 29.9.2
• security Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C in 29.9.2
• security Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C in 29.9.2
• security Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C in 29.9.2
• security Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C in 29.9.2
• security CVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest. in 29.9.1
• security GHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer. in 29.9.1
• security GHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation. in 29.9.1
• security CVE-2026-97032: An HTTP/2 client could crash the daemon by changing the HPACK header table size while sending requests. golang/go#81867 in 29.9.0
• security CVE-2026-78659: An HTTP/2 client could exhaust daemon memory by declaring a large number of fields in a Trailer header, bypassing the header size limits. golang/go#81857 in 29.9.0
• security CVE-2026-78663: An HTTP/2 client could bypass the connection-level flow control limit by resetting streams, making the daemon buffer more request data than the limit allows. golang/go#81743 in 29.9.0
• security CVE-2026-78669: An HTTP/2 client could cause excessive daemon CPU use by opening many streams and repeatedly changing the initial window size. golang/go#81742 in 29.9.0
• security CVE-2026-56857: On Windows, the daemon could create a directory outside its data root if someone with write access to the data root had placed a junction there. golang/go#81739 in 29.9.0
• security Release a node's IPsec security associations and policies when the last container leaves an encrypted overlay network, instead of leaking them until the daemon restarts. moby/moby#53420 in 29.9.0
• security CVE-2026-53493: Pulling a crafted OCI image index with deeply nested or widely fanned-out descriptors could cause unbounded CPU and memory use. GHSA-pg57-6jwg-q645 in 29.8.2
• security CVE-2026-92543: A malicious DNS response could make registry connections skip TLS certificate verification or fall back to HTTP, exposing registry credentials or allowing image substitution. GHSA-7cfq-22r6-qp73 in 29.8.2
• security CVE-2026-92542: Unprivileged users on a Swarm node could inject forged Ethernet frames into encrypted overlay networks on peer nodes. GHSA-6m9p-4h64-m6vh in 29.8.2
• security CVE-2026-93315: A build step could redirect proxy CA cleanup outside the build root filesystem, block it with a special file, or let the build succeed when cleanup failed. GHSA-2f5p-x9ph-g97x in 29.8.2
• security CVE-2026-93316: A build that requested CDI devices could cause a daemon panic when CDI support was disabled, for example with "features": {"cdi": false} in daemon.json. GHSA-r456-g3gm-cvxf in 29.8.2
• security CVE-2026-93317: With the containerd image store, a client using the low-level LLB API could poison the build cache with container blob contents that did not match their claimed digest. GHSA-p3rc-w3hc-pqvv in 29.8.2
• security CVE-2026-93318: A malicious image could poison the build cache with layer DiffIDs that did not match the actual layer contents. GHSA-f2v9-hprr-32q3 in 29.8.2
• security CVE-2026-93319: A malicious external frontend could crash the daemon through gateway container lifecycle races or malformed requests and definitions. GHSA-4hgw-qrhw-fhg8 in 29.8.2
• security CVE-2026-93320: Daemon-side snapshot reads and LLB mkfile operations did not safely handle special files. GHSA-9728-qjrv-2xh2 in 29.8.2
• security CVE-2026-93321: A malformed LLB file operation with invalid symlink owner inputs could crash the daemon. GHSA-fjj4-h6vf-m9hj in 29.8.2
• security CVE-2026-93322: A malformed LLB merge operation with mismatched input counts could crash the daemon. GHSA-cv6p-7w7g-xjwq in 29.8.2
• security CVE-2026-93323: An oversized Dockerfile, .dockerignore, gateway file, or nested LLB definition could exhaust daemon memory. GHSA-mgqf-486f-49vp in 29.8.2
• security CVE-2026-93326: A crafted Git build source could bypass source policy rules that match on the repository URL, through a Git bundle locator or a full remote URL that did not match the source identifier. GHSA-66hf-6vf5-87hc in 29.8.2
• security Add daemon support for configuring the default container AppArmor profile template. moby/moby#52771 in 29.8.0
• security Prevent containers from using the 32-bit socketcall(2) path to create AF_VSOCK sockets and communicate with host virtual machines by adding AppArmor and SELinux policy rules. moby/moby#53551 in 29.8.0

Every release in between