Alpine: multiple docker packages: security update to 29.9.0-r0

critical Tenable Cloud Security Plugin ID 476650

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location,
the operation can create a directory at the junction target even when that target is located outside the
root. This only applies to operations where the last path component is a junction (path/to/junction, but
not path/junction/target). (CVE-2026-56857)

- When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate
the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs
memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header
that declares a large number of fields, causing the server to allocate a disproportionate amount of memory
while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not
applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP
connection, and whose Server.MaxHeaderBytes are calculated differently. (CVE-2026-78659)

- The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client
resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request
handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-
level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the
concurrent stream limit and stream-level flow control. (CVE-2026-78663)

- A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large
number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE
values. (CVE-2026-78669)

- HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This
happens because the server modifies the HPACK encoder from two goroutines without synchronization: one
uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies
the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a
client sends. A malicious client can repeatedly send a request while changing the header table size to
crash the server. (CVE-2026-97032)

Solution

Update the docker library and its related packages to version 29.9.0-r0 or later.

Plugin Details

Severity: Critical

ID: 476650

Version: Revision 1.1

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/22/2026

Updated: 10/22/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.49

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-56857

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-56857, CVE-2026-78659, CVE-2026-78663, CVE-2026-78669, CVE-2026-97032

Detections

Analytics