GO-2026-4883
Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
At a glance
- Published
- Updated
- CVE
- CVE-2026-33997
- Aliases
- GHSA-pxq6-2prw-chj9
Description
Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/docker/docker | introduced 0 |
| Go · github.com/moby/moby | introduced 0 |
| Go · github.com/moby/moby/v2 | introduced 0, fixed 2.0.0-beta.8 |
References
- https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9 ADVISORY
- https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a FIX
- https://docs.docker.com/engine/extend/legacy_plugins WEB
- https://github.com/moby/moby/releases/tag/docker-v29.3.1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |