Skip to content
Threat Feed
Subscribe

Vendor

Moby

3 briefs RSS
high threat

Docker Race Condition Allows Bind Mount Redirection to Host Path (CVE-2026-42306)

A race condition in Docker's `docker cp` command allows a malicious container to redirect a bind mount target to an arbitrary host path by manipulating symlinks during the setup of temporary filesystem views, potentially overwriting host files or causing denial of service.

docker/docker +2 privilege-escalation defense-evasion docker
2r 2t
high threat

Docker `PUT /containers/{id}/archive` Vulnerability Allows Host Root Code Execution

A vulnerability exists in Docker where a malicious container image can execute arbitrary code with host root privileges by exploiting the decompression of compressed archives uploaded via the `PUT /containers/{id}/archive` endpoint, tracked as CVE-2026-41567.

Docker +2 container rce privilege-escalation CVE-2026-41567
2r 1t
high advisory

spdystream SPDY/3 Frame Parser Denial of Service

The SPDY/3 frame parser in spdystream before v0.5.1 improperly validates attacker-controlled counts and lengths, allowing a remote attacker to trigger excessive memory allocation and cause a denial-of-service condition.

spdystream spdy denial-of-service memory-allocation
2r 1t