Package
docker-cli-buildx
Component
github.com/docker/docker
Latest update
8.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
The vulnerable code is the daemon AuthZ plugin middleware, pkg/authorization/authz.go (fix commit moby/moby@6d311e0d, untagged 28.x backport). docker-cli-buildx links exactly one package from the legacy github.com/docker/docker module — pkg/namesgenerator (a random-name table); pkg/authorization and all daemon packages are absent from the build graph (go list -deps). GO-2026-4887 carries no symbol metadata, so govulncheck's fallback flags any linked symbol of the module (namesgenerator.GetRandomName) — a tool limitation, not reachable vulnerable code. The vulnerable code is not included in the artifact.
Status
Impact
Fix for this CVE is available in Docker Engine v29.3.1 and github.com/moby/moby/v2 v2.0.0-beta.8. A fix has also been committed to the moby/moby 28.x branch (https://github.com/moby/moby/commit/6d311e0d8d4174a6347942db78c553fb7dc3762e) but no release has been tagged yet. No backport to older module versions is available. Awaiting upstream maintainer action.
Status