Docker Engine v29.3.1

v29.3.1
Changed 2
  • Update containerd (static binaries) to v2.2.2
  • Update Go runtime to 1.25.8
Fixed 3
  • Fix a daemon crash during docker build if .dockerignore contained an invalid pattern
  • Fix a panic when the containerd client uses a closed stream
  • Add missing build-tag in the Go SDK, which could cause cannot range over 10 (untyped int constant) when importing the cli/command package
Security 4
  • Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions (CVE-2026-34040)
  • Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation (CVE-2026-33997)
  • Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope (CVE-2026-33748)
  • Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory (CVE-2026-33747)

From Docker Engine

29.3.1

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:

Security

This release includes fixes for multiple security vulnerabilities affecting Docker Engine and related components.

  • CVE-2026-34040 Fix an authorization bypass in AuthZ plugins that could allow authorization plugins to be bypassed under specific conditions.
    GHSA-x744-4wpc-v9h2

  • CVE-2026-33997 Fix a flaw in docker plugin install where privilege validation could be partially bypassed, potentially leading to unauthorized privilege escalation.
    GHSA-pxq6-2prw-chj9

  • CVE-2026-33748 Fix insufficient validation of Git URL #ref:subdir fragments in BuildKit, which could allow access to files outside the intended repository scope.
    GHSA-4vrq-3vrq-g6gg

  • CVE-2026-33747 Fix a vulnerability in BuildKit where an untrusted frontend could cause files to be written outside the BuildKit state directory.
    GHSA-3c29-8rgm-jvjj

Bug fixes and enhancements
  • Fix a daemon crash during docker build if .dockerignore contained an invalid pattern. moby/moby#52214
  • Fix a panic when the containerd client uses a closed stream. moby/moby#52211
Packaging updates
Go SDK
  • Add missing build-tag, which could cause cannot range over 10 (untyped int constant) when importing the cli/command package. docker/cli#6884
View original

Upgraded? How did it go?

Discussion