This release includes hardening for CVE-2026-31431.
AF_ALG sockets and the socketcall(2) multiplexer in the default seccomp profile to prevent in-container privilege escalation via the kernel crypto API ("Copy Fail"). moby/moby#52501Fetched May 2, 2026
Security This release includes fixes for multiple security vulnerabilities affecting Docker Engine. A malicious image could supply a malici…
Docker · EngineNew - now supports per-device blkio resource settings - Add endpoint to retrieve in-toto attestation statements (such as SLSA provenance an…
Docker · EngineVault containers no longer have the capipclock capability, preventing calls to mlock() for memory locking—operators should set disablemlock…
HashiCorp · VaultFixed DockerUtil initialization failures caused by Docker daemons returning malformed CIDR values in their /info response, which prevented…
Datadog · Agent