Package
kubevirt-cdi-uploadserver-1.6
Component
github.com/docker/docker
Latest update
6.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
This CVE affects github.com/docker/docker, an indirect dependency of kubevirt/containerized-data-importer. The fix exists only in the docker-v29.3.1 release of the moby/moby repository, which was published under a new Go module path (github.com/moby/moby/v2) — a different path from the one imported by this package (github.com/docker/docker). The fix was never backported to the github.com/docker/docker module path, whose latest available version (v28.5.2+incompatible) does not contain it. A replace directive mapping github.com/docker/docker to github.com/moby/moby/v2 is also not viable, as the two modules have divergent APIs and incompatible import paths that would break the upstream build. Remediation requires upstream involvement.
Status