# CVE-2026-41567: docker.io: Moby is an open source container framework

CVE-2026-41567 is fixed in 9 products on 1 platform, first by SUSE-SU-2026:22367-1, released June 25, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-41567
- Priority: High
- CVSS: 7.2 (high)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 5, 2026

## Description

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | docker amzn 2023 | 25.0.16-1.amzn2023.0.3 | [ALAS2023-2026-1901](https://patchblox.com/security/data/fix/linux/alas2023-2026-1901.md) | Jul 6, 2026 |
| Linux | docker opensuse-leap 16.0 | 29.7.2_ce-160000.8.1 | [OPENSUSE-SU-2026:22158-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22158-1.md) | Nov 7, 2026 |
| Linux | docker sles 15.6 | 29.4.0_ce-150000.253.1 | [SUSE-SU-2026:2692-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2692-1.md) | Jun 30, 2026 |
| Linux | docker sles 15.7 | 29.4.0_ce-150000.253.1 | [SUSE-SU-2026:2692-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2692-1.md) | Jun 30, 2026 |
| Linux | docker sles 16.0 | 29.4.0_ce-160000.7.1 | [SUSE-SU-2026:22367-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22367-1.md) | Jun 25, 2026 |
| Linux | docker-debuginfo amzn 2023 | 25.0.16-1.amzn2023.0.3 | [ALAS2023-2026-1901](https://patchblox.com/security/data/fix/linux/alas2023-2026-1901.md) | Jul 6, 2026 |
| Linux | docker-debugsource amzn 2023 | 25.0.16-1.amzn2023.0.3 | [ALAS2023-2026-1901](https://patchblox.com/security/data/fix/linux/alas2023-2026-1901.md) | Jul 6, 2026 |
| Linux | docker-stable opensuse-leap 16.0 | 24.0.9_ce-160000.6.1 | [OPENSUSE-SU-2026:21205-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21205-1.md) | Jul 2, 2026 |
| Linux | docker-stable sles 15.6 | 24.0.9_ce-150000.1.48.1 | [SUSE-SU-2026:4535-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4535-1.md) | Oct 6, 2026 |
| Linux | docker-stable sles 15.7 | 24.0.9_ce-150000.1.48.1 | [SUSE-SU-2026:4535-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4535-1.md) | Oct 6, 2026 |
| Linux | docker.io Debian 13.5 (trixie) | 26.1.5+dfsg1-9+deb13u1 | [DEBIAN-CVE-2026-41567](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41567.md) | Jun 30, 2026 |
| Linux | docker.io Debian 14 | 28.5.2+dfsg4-3 | [DEBIAN-CVE-2026-41567](https://patchblox.com/security/data/fix/linux/debian-cve-2026-41567.md) | Jun 30, 2026 |
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |
| Linux | nuclei Fedora 43 | 3.11.0-1.fc43 | [FEDORA-2026-D36CA2DD19](https://patchblox.com/security/data/fix/linux/fedora-2026-d36ca2dd19.md) | Jul 13, 2026 |
| Linux | nuclei-debuginfo Fedora 43 | 3.11.0-1.fc43 | [FEDORA-2026-D36CA2DD19](https://patchblox.com/security/data/fix/linux/fedora-2026-d36ca2dd19.md) | Jul 13, 2026 |
| Linux | nuclei-debugsource Fedora 43 | 3.11.0-1.fc43 | [FEDORA-2026-D36CA2DD19](https://patchblox.com/security/data/fix/linux/fedora-2026-d36ca2dd19.md) | Jul 13, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.