ALPINE-CVE-2026-115538: High severity alpine/docker vulnerability
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. The missing rules cause outgoing VXLAN datagrams to bypass IPsec encryption and remove the protection against incoming cleartext VXLAN traffic. The condition is not logged by dockerd and persists until the encrypted network's last local endpoint is removed and another is added, or dockerd is restarted. Each further firewalld event repeats the condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/dockerto a version that resolves this vulnerability.Fixed in 29.9.3-r0 - Operational
To restore the encrypted overlay network state, remove the encrypted network's last local endpoint and add another endpoint, or restart dockerd.
Event History
Frequently Asked Questions
Which deployments are exposed to this condition?
Docker Engine deployments using encrypted overlay networks are exposed when firewalld deletes the associated iptables rules, such as during a firewalld reload or start event. The issue concerns the overlay network driver specifically.
What must happen for traffic protections to be lost?
A firewalld event must delete the iptables rules for an encrypted overlay network. Because the overlay driver does not handle the relevant firewalld D-Bus signals, subsequent outgoing VXLAN traffic can bypass IPsec and incoming cleartext VXLAN traffic is no longer blocked.
How can administrators tell that the condition has occurred?
dockerd does not log this condition. Administrators need to check whether firewalld has reloaded or started and whether the encrypted overlay network's required iptables rules are present.
What restores protection if immediate patching is not possible?
Restart dockerd, or remove the encrypted network's last local endpoint and then add another endpoint. This recovery must be repeated after each further firewalld event that deletes the rules.