Package
rke2-runtime-fips-1.36
Component
github.com/docker/docker
Latest update
8.8
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The rke2 binary bundles github.com/docker/docker as a transitive Go module dependency (via k3s); rke2-runtime-fips-1.36 currently ships v28.5.2+incompatible, which is in range for GHSA-x744-4wpc-v9h2 / CVE-2026-34040. No patched release exists on this module path: the advisory's fixed version (29.3.1) was never published as a github.com/docker/docker Go module — the newest version on that path is v28.5.2+incompatible per the Go module proxy — and the fix ships only in the relocated module github.com/moby/moby/v2 (>= v2.0.0-beta.8), which requires an upstream import-path migration in rke2/k3s. No 28.x backport has been published. Remediation depends on upstream rke2/k3s adopting the fixed module line.
Status