Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d36ca2dd19 advisory.

    Update to 3.11.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a8abe43fb advisory.

    Update to 3.11.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1901 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to     v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or     piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from     the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious     container image containing a trojanized decompression binary can achieve arbitrary code execution with     full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a     compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and     moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using     authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding     piping compressed archives into containers created from untrusted images (CVE-2026-41567)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4179e03375 advisory.

    Update to 3.13.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a5e27945f7 advisory.

    Update to 2.112.0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-01a1840582 advisory.

    Update to 3.13.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-112 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to     v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or     piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from     the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious     container image containing a trojanized decompression binary can achieve arbitrary code execution with     full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a     compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and     moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using     authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding     piping compressed archives into containers created from untrusted images (CVE-2026-41567)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-134 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to     v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or     piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from     the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious     container image containing a trojanized decompression binary can achieve arbitrary code execution with     full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a     compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and     moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using     authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding     piping compressed archives into containers created from untrusted images (CVE-2026-41567)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-131 advisory.

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject     Alternative Name (SAN) entries. This caused strings.Split(host, .) to execute repeatedly on the same     input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of     SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before     building the certificate chain, this overhead occurred even for untrusted certificates. (CVE-2026-27145)

    Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to     v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or     piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from     the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious     container image containing a trojanized decompression binary can achieve arbitrary code execution with     full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a     compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and     moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using     authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding     piping compressed archives into containers created from untrusted images (CVE-2026-41567)

    Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive     CPU. (CVE-2026-42504)

    When returning errors, functions in the net/textproto package would include its input as part of the     error. This might allow an attacker to inject misleading content to errors that are printed or logged.
    (CVE-2026-42507)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the docker package has been released.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21205-1 advisory.

    This update for docker-stable fixes the following issues

    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260279).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265782).
    - CVE-2026-33997: moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin     installation       (bsc#1265907).
    - CVE-2026-34040: Authz zero length regression (bsc#1265929).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266625).
    - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed     archive into       that container (bsc#1267827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Docker Engine (Moby) installed on the remote host is prior to 29.5.1. It is, therefore, affected by an arbitrary code execution vulnerability:

  - When a compressed archive is uploaded to a container via PUT /containers/{id}/archive or piped through docker     cp -, the daemon resolves decompression binaries (such as xz or unpigz) from the container's filesystem rather     than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized     decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID     and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container.
    (CVE-2026-41567)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2692-1 advisory.

    This update for docker fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265782).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266625).
    - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate     validation can be       used to bypass some authorization controls (bsc#1262346).
    - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed     archive into       that container (bsc#1267827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21060-1 advisory.

    This update for docker fixes the following issues

    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265782).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266625).
    - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate     validation can be       used to bypass some authorization controls (bsc#1262346).
    - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed     archive into       that container (bsc#1267827).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to     v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or     piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from     the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious     container image containing a trojanized decompression binary can achieve arbitrary code execution with     full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a     compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and     moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using     authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding     piping compressed archives into containers created from untrusted images (CVE-2026-41567)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to
    v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or
    piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from
    the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious
    container image containing a trojanized decompression binary can achieve arbitrary code execution with
    full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a
    compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and
    moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using
    authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding
    piping compressed archives into containers created from untrusted images (CVE-2026-41567)

ID	Name	Product	Family	Type	Severity
328927	Fedora 43 : nuclei (2026-d36ca2dd19)	Nessus	Fedora Local Security Checks	Local	medium
328869	Fedora 44 : nuclei (2026-3a8abe43fb)	Nessus	Fedora Local Security Checks	Local	medium
327403	Amazon Linux 2023 : docker (ALAS2023-2026-1901)	Nessus	Amazon Linux Local Security Checks	Local	high
326366	Fedora 43 : prometheus (2026-4179e03375)	Nessus	Fedora Local Security Checks	Local	high
326362	Fedora 44 : jfrog-cli (2026-a5e27945f7)	Nessus	Fedora Local Security Checks	Local	high
326356	Fedora 44 : prometheus (2026-01a1840582)	Nessus	Fedora Local Security Checks	Local	high
325579	Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-112 (ALASNITRO-ENCLAVES-2026-112)	Nessus	Amazon Linux Local Security Checks	Local	high
325567	Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-134 (ALASDOCKER-2026-134)	Nessus	Amazon Linux Local Security Checks	Local	high
325565	Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-131 (ALASECS-2026-131)	Nessus	Amazon Linux Local Security Checks	Local	high
325084	Photon OS 4.0: Docker PHSA-2026-4.0-1050	Nessus	PhotonOS Local Security Checks	Local	high
325040	openSUSE 16: docker-stable / docker-stable-bash-completion / etc (openSUSE-SU-2026:21205-1)	Nessus	SuSE Local Security Checks	Local	high
324948	Docker Engine < 29.5.1 Arbitrary Code Execution	Nessus	Misc.	Local	high
324841	SUSE SLED15: docker / docker-bash-completion / docker-buildx / etc (SUSE-SU-2026:2692-1)	Nessus	SuSE Local Security Checks	Local	high
324067	openSUSE 16: docker / docker-bash-completion / docker-buildx / etc (openSUSE-SU-2026:21060-1)	Nessus	SuSE Local Security Checks	Local	high
320818	Linux Distros Unpatched Vulnerability : CVE-2026-41567	Nessus	Misc.	Local	high
442038	SCA: security update for github.com/moby/moby/v2 (GHSA-x86f-5xw2-fm2r)	Tenable Cloud Security	SCA Checks	Local	high
442038	SCA: security update for github.com/moby/moby/v2 (GHSA-x86f-5xw2-fm2r)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-41567

high

Tenable Plugins

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high