CVE-2024-36621: Race Condition
Last updated 1 May 2025
Other sources
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/moby/mobyto a version that resolves this vulnerability.Fixed in 26.0.0 - Upgrade
Upgrade
debian/docker.ioto a version that resolves this vulnerability.Fixed in 26.1.4+dfsg1-9 - Upgrade
Upgrade
debian/docker.ioto a version that resolves this vulnerability.Fixed in 26.1.5+dfsg1-9+deb13u1Fixed in 28.5.2+dfsg4-5
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36621?
CVE-2024-36621 is classified as a medium severity vulnerability due to its potential for resource leaks.
How do I fix CVE-2024-36621?
To fix CVE-2024-36621, upgrade to version 26.0.0 or later of the Moby software.
What type of vulnerability is CVE-2024-36621?
CVE-2024-36621 is a race condition vulnerability affecting concurrent build processes.
Which versions of Moby are affected by CVE-2024-36621?
Versions of Moby prior to 26.0.0 are affected by CVE-2024-36621.
What impacts can CVE-2024-36621 have on my system?
CVE-2024-36621 can lead to resource exhaustion which may degrade performance or cause service interruptions.