OESA-2026-4858: docker security update
Docker is an open source project to build, ship and run any application as a lightweight container. Security Fix(es):
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.(CVE-2026-92543)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/dockerto a version that resolves this vulnerability.Fixed in engine-18.09.0-358.oe2403sp4
Event History
Frequently Asked Questions
Which registry connections are exposed to this issue?
Registry hostnames whose DNS responses include both a loopback address and a non-loopback attacker-controlled address can be classified as insecure. The default insecure CIDR list includes 127.0.0.0/8 and ::1/128.
What must an attacker be able to do to exploit it?
An attacker needs to cause the target registry hostname to resolve to an answer set containing a loopback IP address and a non-loopback attacker IP address. The user must then initiate a registry connection, as indicated by the required user interaction metric.
What is the security impact of an insecure classification?
Certificate verification is disabled and HTTP fallback is enabled for the registry connection. Because the transport reconnects using the hostname rather than the address that matched the insecure CIDR, it can connect to the non-loopback attacker address.