azure linux moby-engine vulnerabilities

Latest azure linux moby-engine CVEs

Newest publication first · page 1 of 3

1. CVE-2026-121520 Malicious client could set xattr value outside of BuildKit state directory

   Published 2026-11-03

   Medium·CVSS 4.5 EPSS 0.14%

   In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. namespaces may also be se...

2. CVE-2026-116591 compress zstd: Panic on two-block frames

   Published 2026-10-26

   High·CVSS 8.7 EPSS 0.33%

   compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count al...

3. CVE-2026-95838 containerd: Unpack DoS via repeated opaque whiteouts

   Published 2026-10-12

   Medium·CVSS 4.6 EPSS 0.22%

   containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque...

4. CVE-2026-97032 HTTP/2 server crash due to HPACK encoder race in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.68%

   HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to...

5. CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.85%

   A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

6. CVE-2026-78663 Double flow control refund on HTTP/2 server streams in net/http

   Published 2026-10-08

   Critical·CVSS 9.1 EPSS 0.86%

   The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to...

7. CVE-2026-78660 HTTP/2 transport accepts malformed framing-related headers in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.54%

   Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client...

8. CVE-2026-78659 HTTP/2 server memory exhaustion due to Trailer headers in net/http

   Published 2026-10-08

   High·CVSS 7.5 EPSS 0.87%

   When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit...

9. CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

   Published 2026-10-08

   Medium·CVSS 5.5 EPSS 0.12%

   The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can sup...

10. CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses

    Published 2026-10-07

    High·CVSS 7.6 EPSS 0.09%

    Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecu...

11. CVE-2026-92542 Blind VXLAN injection into encrypted overlay networks from cluster peer

    Published 2026-10-07

    Medium·CVSS 6.9 EPSS 0.07%

    The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay...

12. CVE-2026-93321 Malformed LLB file operation can crash buildkitd

    Published 2026-10-05

    Medium·CVSS 6.9 EPSS 0.16%

    A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

13. CVE-2026-93326 Crafted Git build source can bypass certain policy validation

    Published 2026-10-05

    Medium·CVSS 6.0 EPSS 0.25%

    A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more strict...

14. CVE-2026-93323 Oversized Dockerfile or .dockerignore can exhaust buildkitd memory

    Published 2026-10-05

    Medium·CVSS 6.8 EPSS 0.11%

    The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating th...

15. CVE-2026-93322 Malformed MergeOp can crash the BuildKit daemon

    Published 2026-10-05

    Medium·CVSS 6.9 EPSS 0.13%

    A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

16. CVE-2026-93320 BuildKit improperly handles special files in build snapshots

    Published 2026-10-05

    Medium·CVSS 6.0 EPSS 0.11%

    BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

17. CVE-2026-93319 A malicious frontend can cause a daemon panic

    Published 2026-10-05

    Medium·CVSS 5.7 EPSS 0.09%

    A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

18. CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs

    Published 2026-10-05

    High·CVSS 7.5 EPSS 0.17%

    A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKi...

19. CVE-2026-81870 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

    Published 2026-09-16

    Low·CVSS 2.0 EPSS 0.27%

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client conf...

20. CVE-2026-84445 gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

    Published 2026-09-14

    High·CVSS 8.7 EPSS 0.64%

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/se...

21. CVE-2026-78662 Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh

    Published 2026-09-02

    High·CVSS 7.5 EPSS 0.43%

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such...

22. CVE-2026-56855 Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh

    Published 2026-09-02

    High·CVSS 7.5 EPSS 0.50%

    Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and t...

23. CVE-2026-84304 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

    Published 2026-09-01

    High·CVSS 8.7 EPSS 0.61%

    gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain...

24. CVE-2026-37236 grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST reque...

    Published 2026-08-28

    Critical·CVSS 9.8 EPSS 0.43%

    grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the...

25. CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload

    Published 2026-08-19

    High·CVSS 7.2 EPSS 0.54%

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. Th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.