openSUSE-SU-2026:22158-1

openSUSE-SU-2026:22158-1 · Security update for docker

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This update for docker fixes the following issues: Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265782). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266625). - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262346). - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into that container (bsc#1267827). Non security issue fixed: - SELinux CIL files are not shipped in Docker (bsc#1278193). Changes for docker: - Update to Docker 29.7.2. See upstream changelog online at <https://docs.docker.com/engine/release-notes/29/#2972> fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176) - Update to buildx 0.36.1. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.36.1>

Fix available

Published

2026-10-23T09:06:49Z

Updated

2026-10-24T17:23:12.289189433Z

Stack: system

Check your server →