Go/github.com/moby/moby/v2 CVE-2026-34040: high 8.8, EPSS 9.27%

Moby has AuthZ plugin bypass when provided oversized request bodies

Action: Upgrade github.com/moby/moby/v2 to 2.0.0-beta.8 or later.

go get github.com/moby/moby/v2@v2.0.0-beta.8

Affected

Fixed versions

Sources

• osv: GHSA-x744-4wpc-v9h2#Go/github.com/moby/moby/v2
• https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq
• https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2
• https://nvd.nist.gov/vuln/detail/CVE-2026-34040
• https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38
• https://docs.docker.com/engine/extend/plugins_authorization
• https://github.com/moby/moby
• https://github.com/moby/moby/releases/tag/docker-v29.3.1

CVE-2026-34040 · published 2026-03-27T17:43:16Z · modified 2026-09-08T05:15:04.303637708Z · JSON