Skip to content
Fencer Vulns
critical 10.0

CVE-2024-41110 in the critical feed json

Moby authz zero length regression

published 2024-07-23 2 y ago modified 2026-09-10 59 d ago also EUVD-2024-2415 , GHSA-v23v-6jw2-98fq , GO-2024-3005

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
16.5%
EPSS 16.5% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low.

Using a specially-crafted API request, an Engine API client could make the daemon forward the request or response to an authorization plugin without the body. In certain circumstances, the authorization plugin may allow a request which it would have otherwise denied if the body had been forwarded to it.

A security issue was discovered In 2018, where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later major versions, resulting in a regression. Anyone who depends on authorization plugins that introspect the request and/or response body to make access control decisions is potentially impacted.

Docker EE v19.03.x and all versions of Mirantis Container Runtime are not vulnerable.

docker-ce v27.1.1 containes patches to fix the vulnerability. Patches have also been merged into the master, 19.03, 20.0, 23.0, 24.0, 25.0, 26.0, and 26.1 release branches. If one is unable to upgrade immediately, avoid using AuthZ plugins and/or restrict access to the Docker API to trusted parties, following the principle of least privilege.

Patch / fix

  • go github.com/docker/docker 23.0.15, 25.0.6, 25.0.6+incompatible, 26.1.5, 26.1.5+incompatible, 27.1.1, 27.1.1+incompatible
  • go github.com/moby/moby 25.0.6+incompatible, 26.1.5+incompatible, 27.1.1+incompatible
  • docker docker 23.0.15, 25.0.6, 26.1.5, 27.1.1
  • mobyproject moby 23.0.15, 25.0.6, 26.1.5, 27.1.1
  • docker.io Debian 12 20.10.24+dfsg1-1+deb12u1
  • docker.io Debian 14, Debian 13 26.1.5+dfsg1-2

debian advisories DEBIAN-CVE-2024-41110

  • docker.io-app Ubuntu 22.04 LTS 27.5.1-0ubuntu3~22.04.2
  • docker.io-app Ubuntu 24.04 LTS 27.5.1-0ubuntu3~24.04.2
  • docker.io Ubuntu Pro 18.04 LTS 20.10.21-0ubuntu1~18.04.3+esm1
  • docker.io Ubuntu Pro 20.04 LTS 20.10.21-0ubuntu1~20.04.6+esm1
  • docker.io Ubuntu Pro 22.04 LTS 20.10.21-0ubuntu1~22.04.7+esm1
  • docker.io Ubuntu Pro 24.04 LTS 20.10.25+dfsg1-2ubuntu1+esm1
  • docker.io-app Ubuntu Pro 20.04 LTS 26.1.3-0ubuntu1~20.04.1+esm1
  • docker.io-app Ubuntu Pro 22.04 LTS 26.1.3-0ubuntu1~22.04.1+esm1

ubuntu advisories UBUNTU-CVE-2024-41110

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • docker-stable SLE Module for Containers 15 SP7, openSUSE Leap 15.6 24.0.9_ce-150000.1.39.1
  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 24.0.9_ce-150000.1.25.1
  • docker Linux Micro 6.1 27.5.1_ce-slfo.1.1_1.1
  • docker-stable SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +11 more 24.0.9_ce-150000.1.15.1
  • docker SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +16 more 27.5.1_ce-150000.218.1
  • apptainer SLE Module for HPC 15 SP6, openSUSE Leap 15.6 1.3.6-150600.4.9.1
  • docker Linux Micro 6.0 26.1.5_ce-1.1
  • docker Linux Micro 6.0 25.0.6_ce-1.1

suse advisories SUSE-SU-2026:1118-1SUSE-SU-2026:0972-1SUSE-SU-2025:03545-1SUSE-SU-2025:03540-1SUSE-SU-2025:1102-1SUSE-SU-2025:20259-1

  • apptainer openSUSE Tumbleweed 1.3.6-5.1
  • docker-stable openSUSE Tumbleweed 24.0.9_ce-1.1
  • docker openSUSE Tumbleweed 26.1.5_ce-1.1
  • nova openSUSE Tumbleweed 3.10.0-1.1

opensuse advisories openSUSE-SU-2025:14909-1openSUSE-SU-2024:14446-1openSUSE-SU-2024:14229-1openSUSE-SU-2024:14235-1

  • docker Alpine 3.20 26.1.5-r0
  • docker Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 27.1.1-r0

alpine advisories ALPINE-CVE-2024-41110

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • moby-engine Azure Linux 3.0 25.0.3-5
  • moby-engine CBL-Mariner 2.0 24.0.9-7

azure linux advisories AZL-47017AZL-47042

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-41110 updated cvss 9.9

moby: Authz zero length regression

  • Red Hat Enterprise Linux 7 docker
    affected: no fix available
  • Red Hat OpenShift Container Platform 3.11 podman
    affected: no fix planned “Out of support scope”
  • Red Hat cert-manager operator for Red Hat OpenShift 1.14 cert-manager v1.14.7-1743759417
    fixed: vendor fix RHSA-2025:3714
  • Red Hat cert-manager operator for Red Hat OpenShift 1.14 cert-manager v1.14.7-1743760064 Red Hat Enterprise Linux 8 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +2 more Red Hat Enterprise Linux 9 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +1 more Red Hat Enterprise Linux 10 podman
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +3 more
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

16.50% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GitHub 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/docker/docker
>=19.03.0, <23.0.15
>=26.0.0, <26.1.5
>=27.0.0, <27.1.1
>=24.0.0, <25.0.6
>=20.10.0+incompatible, <25.0.6+incompatible
>=26.0.0+incompatible, <26.1.5+incompatible
>=27.0.0+incompatible, <27.1.1+incompatible
23.0.15
26.1.5
27.1.1
25.0.6
25.0.6+incompatible
26.1.5+incompatible
27.1.1+incompatible
go github.com/moby/moby
>=20.10.0+incompatible, <25.0.6+incompatible
>=26.0.0+incompatible, <26.1.5+incompatible
>=27.0.0+incompatible, <27.1.1+incompatible
25.0.6+incompatible
26.1.5+incompatible
27.1.1+incompatible

Affected products

  • moby moby
  • docker moby

Classification

Weakness
  • CWE-187 Partial String Comparison
  • CWE-444 Inconsistent Interpretation of HTTP Requests
  • CWE-863 Incorrect Authorization
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of moby/moby published their own advisory on GitHub. Reviewed sources take precedence over it.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.