{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/moby/moby","cve_ids":["CVE-2026-34040"],"ecosystem":"Go","epss":0.09113,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-x744-4wpc-v9h2","id":"tcs_01M5KGGSBNE40ADM0G7NT7WEMC","modified_at":"2026-04-03T20:59:19.226161232Z","published_at":"2026-04-02T18:42:30Z","references":["https://osv.dev/vulnerability/GO-2026-4887","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4887#Go/github.com/moby/moby","url":"https://osv.dev/vulnerability/GO-2026-4887"}],"summary":"Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker"}