FOSSWire
Search/
Cloud Native & eBPF

Docker Engine v29.9.3 release addresses multiple security vulnerabilities

Brief written by the FOSSWire AI editor from Docker / Moby Engine How we write

1 min read

Key Takeaway

Docker Engine v29.9.3 patches critical security flaws in SwarmKit, BuildKit, and RSA key parsing to prevent privilege escalation and denial of service.

Summary

The Moby project has released Docker Engine version 29.9.3, which focuses heavily on resolving several security vulnerabilities across its core components. The update addresses flaws in the Docker daemon, SwarmKit, and the BuildKit build engine, targeting risks ranging from resource exhaustion to unauthorized certificate acquisition.

In addition to security patches, this release includes stability improvements for the daemon under heavy load and fixes for YAML emission in the Docker CLI. Users running Docker Swarm or utilizing BuildKit for container image construction are specifically encouraged to update to mitigate potential host-level privilege escalation and network spoofing risks.

Security and stability improvements in v29.9.3

  • Security Vulnerabilities: Patches include fixes for CVE-2026-116587 (excessive CPU usage during RSA key parsing) and CVE-2026-116591 (daemon panic during zstd decompression).
  • SwarmKit Protections: Addresses CVE-2026-115538, which prevented spoofing and encryption loss in Swarm overlay networks following firewalld iptables flushes, and CVE-2026-115539, which prevented worker nodes from obtaining manager certificates after a leader change.
  • BuildKit Enhancements: Updates BuildKit to v0.34.2 to resolve cache poisoning via Git metadata (GHSA-2fqp-xg6f-v7gj) and a privilege escalation flaw where malicious clients could set extended attributes outside the BuildKit state directory (GHSA-w26x-xg27-7qjc).
  • Daemon Stability: Resolves a bug where the daemon would hang during container, image, and system API requests when operating under high load.
  • CLI Refinements: Fixes an issue in the Docker CLI where literal '<<' keys in YAML files were emitted without necessary quotes.

Why it matters

This release is critical for system administrators and DevOps engineers managing production container clusters, particularly those using Docker Swarm or BuildKit. The fixes prevent attackers from potentially compromising host systems or intercepting network traffic within overlay networks, ensuring more robust multi-tenant environments.

What to do

  • Update Docker Engine to version 29.9.3 to patch critical security vulnerabilities in SwarmKit, BuildKit, and RSA key parsing.
  • Watch for resolved daemon hangs during container, image, and system API requests under heavy load after updating.

Original reference: github.com →