Docker Engine 29.9.0 → 29.9.3

Breaking changes

None in the release notes.

Security changes

• security CVE-2026-116587 Fix possible excessive CPU usage when parsing crafted RSA keys GHSA-mgcc-cww5-fp2q in 29.9.3
• security CVE-2026-116591 Fix a possible panic when decompressing zstd data GHSA-fpmh-frq8-7rj8 in 29.9.3
• security CVE-2026-115538 Fix missing encryption and spoofing protections for Swarm overlay networks after firewalld flushes Docker's iptables rules GHSA-6jhp-7446-hf7f in 29.9.3
• security CVE-2026-115539 Fix a vulnerability where an attacker with a valid worker-node TLS certificate and private key could obtain a manager-node certificate shortly after a Swarm leader change GHSA-628g-hv7f-pgjc in 29.9.3
• security GHSA-2fqp-xg6f-v7gj: A build that resolved metadata for the same Git source reference twice could crash the daemon through resolver cache poisoning. in 29.9.3
• security GHSA-w26x-xg27-7qjc: A malicious client with access to the BuildKit control APIs could set extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host. in 29.9.3
• security The Go runtime update addresses CVE-2026-111943 by rejecting certificate chains that include eight revoked eMudhra intermediate certificates. Image pulls and pushes fail TLS certificate verification if a registry's certificate chain relies on one of the affected TLS intermediates. Affected… in 29.9.2
• security Domain-validated TLS: EM DV TLS CA - G3B and EM DV TLS CA - G3C in 29.9.2
• security Organization-validated TLS: EM OV TLS CA - G3B and EM OV TLS CA - G3C in 29.9.2
• security Extended-validation TLS: EM EV TLS CA - G3B and EM EV TLS CA - G3C in 29.9.2
• security Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C in 29.9.2
• security CVE-2026-95839: Pulling or importing an image through containerd's transfer service could crash containerd if a child descriptor contained the io.containerd.manifest.subject annotation and a malformed digest. in 29.9.1
• security GHSA-8647-2jxj-p2rc: An untrusted registry returning a crafted Content-Length header could crash containerd when parallel layer fetching was enabled with concurrent_layer_fetch_buffer. in 29.9.1
• security GHSA-hc94-p972-ch66: Pulling a crafted image or pulling from a malicious registry could exhaust host disk space because containerd did not limit incoming layer data to the declared size before validation. in 29.9.1

Every release in between