Read the docs
TI-2021-04385 Aliases CVE-2021-21285GHSA-6fj5-m822-rqx8

Docker daemon crash during image pull of malicious image

Priority LOW 35CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

Why it matters now

EPSS 0.03327 88th percentileScored 2026-11-07
Fix Partial moby (moby): 19.03.15, 20.10.3github.com/moby/moby (Go): 19.3.15, 20.10.3Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
mobymobybefore 19.03.15; 20.0.0 to before 20.10.319.03.15, 20.10.3Patch availableCNA
—github.com/moby/moby (Go)before 19.3.1519.3.15Patch availableGHSA-6fj5-m822-rqx8
—github.com/moby/moby (Go)20.10.0-beta1 to before 20.10.320.10.3Patch availableGHSA-6fj5-m822-rqx8
  • moby Vendormoby Affected before 19.03.15; 20.0.0 to before 20.10.3 Fixed in 19.03.15, 20.10.3 Patch available CNA
  • github.com/moby/moby (Go) Vendor— Affected before 19.3.15 Fixed in 19.3.15 Patch available GHSA-6fj5-m822-rqx8
  • github.com/moby/moby (Go) Vendor— Affected 20.10.0-beta1 to before 20.10.3 Fixed in 20.10.3 Patch available GHSA-6fj5-m822-rqx8

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*before 19.03.15; 20.0.0 to before 20.10.3VulnerableDocker
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*11.0 – 11.60.3VulnerableNetApp
  • cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* Versions before 19.03.15; 20.0.0 to before 20.10.3 Vulnerable ·Docker
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.60.3 Vulnerable ·NetApp

Remediation

  • Fix · CNA moby (moby) Fixed in 19.03.15, 20.10.3
  • Fix · GHSA-6fj5-m822-rqx8 github.com/moby/moby (Go) Fixed in 19.3.15 Advisory →
  • Fix · GHSA-6fj5-m822-rqx8 github.com/moby/moby (Go) Fixed in 20.10.3 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21285
  2. 2026-10-03 Alias added: GHSA-6fj5-m822-rqx8

References

Patch 2

Advisory 7

Other 1

  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
  • TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
  • TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
  • TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
  • TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences