High [CVE-2026-92543] Docker Engine classifies a registry hostname as insecure using an any-match DNS check
This high-severity Docker advisory covers CVE-2026-92543 affecting Docker Engine, Moby.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Docker CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list.
Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Affected products named by the advisory: Moby.
- Docker Engine before 29.8.2
- Moby before v2.0.0-beta.25
NVD record · high-confidence parse· fetched 1 day ago·verify at source
- 29.8.2
- v2.0.0-beta.25
NVD record · high-confidence parse· fetched 1 day ago·verify at source
Mitigation
Upgrade to a fixed release: 29.8.2, v2.0.0-beta.25. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
NVD record · high-confidence parse· fetched 1 day ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.