moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package…
Priority LOW 36CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00642 51st percentileScored 2026-11-07
Fix Fixed github.com/moby/moby (Go): 25.0.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/moby/moby (Go) | before 25.0.4 | 25.0.4 | Patch available | GHSA-gh5c-3h97-2f3q |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/moby/moby (Go) Vendor— Affected before 25.0.4 Fixed in 25.0.4 Patch available GHSA-gh5c-3h97-2f3q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* | up to 25.0.3 | Vulnerable | Mobyproject |
- cpe:2.3:a:mobyproject:moby:*:*:*:*:*:*:*:* Versions up to 25.0.3 Vulnerable ·Mobyproject
Remediation
- Fix · GHSA-gh5c-3h97-2f3q github.com/moby/moby (Go) Fixed in 25.0.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 7 products
- Multicluster Engine for Kubernetes
- OpenShift Service Mesh 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Ceph Storage 7
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-36623
- 2026-10-03 Alias added: GHSA-gh5c-3h97-2f3q
- 2026-10-21 EPSS moved to the 50th–90th percentile
References
Patch 2
Advisory 2
More Mobyproject Moby vulnerabilities
- TI-2023-13346 moby/moby's dockerd daemon encrypted overlay network may be unauthenticated CVSS 3.1HIGH 8.7
- TI-2024-19200 External DNS requests from 'internal' networks could lead to data exfiltration CVSS 3.1HIGH 7.5
- TI-2018-09052 An issue was discovered in Docker Moby before 17.06.0. CVSS 3.0HIGH 7.5
- TI-2024-16178 Moby classic builder cache poisoning CVSS 3.1HIGH 7.8
- TI-2023-13348 moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated CVSS 3.1MEDIUM 6.8
- TI-2021-17933 Insufficiently restricted permissions on data directory in Docker Engine CVSS 3.1MEDIUM 6.3
Sources
- CVE-2024-36623 · CVE Program
- CVE-2024-36623 · NVD
- FIRST EPSS
- GHSA-gh5c-3h97-2f3q · GitHub Advisory Database · CC BY 4.0
- CVE-2024-36623 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences