Docker Engine 29.9.2 → 29.9.3

Breaking changes

None in the release notes.

Security changes

• security CVE-2026-116587 Fix possible excessive CPU usage when parsing crafted RSA keys GHSA-mgcc-cww5-fp2q in 29.9.3
• security CVE-2026-116591 Fix a possible panic when decompressing zstd data GHSA-fpmh-frq8-7rj8 in 29.9.3
• security CVE-2026-115538 Fix missing encryption and spoofing protections for Swarm overlay networks after firewalld flushes Docker's iptables rules GHSA-6jhp-7446-hf7f in 29.9.3
• security CVE-2026-115539 Fix a vulnerability where an attacker with a valid worker-node TLS certificate and private key could obtain a manager-node certificate shortly after a Swarm leader change GHSA-628g-hv7f-pgjc in 29.9.3
• security GHSA-2fqp-xg6f-v7gj: A build that resolved metadata for the same Git source reference twice could crash the daemon through resolver cache poisoning. in 29.9.3
• security GHSA-w26x-xg27-7qjc: A malicious client with access to the BuildKit control APIs could set extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host. in 29.9.3

Every release in between