Debian ships its own builds of Docker (docker.io), containerd and runc. On 16 August 2026 DSA-6443-1 fixed seven vulnerabilities in Docker and its bundled BuildKit for Debian 13 (trixie), and on 2 December 2025 DSA-6067-1 fixed two in containerd for Debian 12 and 13. At the same time, Debian's security tracker still lists several container-runtime CVEs as open, which is worth knowing when you decide where your Docker packages come from.
At a glance
| Package | Release | Fixed version | Advisory |
|---|---|---|---|
| docker.io | Debian 13 (trixie) | 26.1.5+dfsg1-9+deb13u1 | DSA-6443-1 (16 Aug 2026) |
| containerd | Debian 13 (trixie) | 1.7.24~ds1-6+deb13u1 | DSA-6067-1 (2 Dec 2025) |
| containerd | Debian 12 (bookworm) | 1.6.20~ds1-1+deb12u2 | DSA-6067-1 (2 Dec 2025) |
Severity: High. The highest-rated fixed issue, CVE-2026-34040, is rated high by the Moby project (CVSS 3.1 8.8). None of the CVEs on this page is in CISA's Known Exploited Vulnerabilities catalog (30 Oct 2026).
What was fixed
Debian says the Docker issues may result in privilege escalation, arbitrary file access on the host, or bypass of authorization policies:
- Authorization and plugins. CVE-2026-34040 lets requests bypass authorization (AuthZ) plugins; CVE-2026-33997 lets
docker plugin installaccept a plugin with more privileges than were approved. Moby fixed both in 29.3.1. - docker cp. CVE-2026-41568 and CVE-2026-42306 are race conditions during
docker cpthat a malicious container can use to create files or redirect a bind mount on the host. CVE-2026-41567 concerns how the daemon finds decompression tools for archives uploaded into a container. - BuildKit. CVE-2026-33747 lets a custom BuildKit frontend write files outside the BuildKit state directory, and CVE-2026-33748 allows reading files outside a checked-out Git repository through a crafted URL fragment.
For containerd, DSA-6067-1 fixed CVE-2024-25621, overly broad default permissions on directories such as /var/lib/containerd that could allow local privilege escalation, and CVE-2025-64329, a memory exhaustion in the CRI Attach implementation.
What is still open
When we checked the tracker on 31 October 2026:
- Docker on Debian 12. bookworm's
docker.io(20.10.24) has no fix for the 2026 Docker CVEs listed above. - runc. CVE-2025-31133, CVE-2025-52565 and CVE-2025-52881, published in November 2025, are listed as open for both bookworm and trixie. The runc project rates CVE-2025-31133 high; its record describes possible host information disclosure, denial of service or container escape. Upstream fixed it in 1.2.8 and 1.3.3.
- containerd on Debian 13. Several 2026 CVEs are open, including CVE-2026-53488, which containerd rates critical: image labels passed through the CRI plugin, the interface Kubernetes uses, may lead to command execution on the host. It affects containerd 1.7 before 1.7.33; trixie ships 1.7.24.
Debian's docker.io depends on Debian's containerd and runc packages, so these gaps apply to Docker installed from Debian.
Are you affected?
dpkg -l docker.io docker-ce containerd containerd.io runc 2>/dev/null | grep '^ii'
apt policy docker.io containerd runc
sudo docker version --format '{{.Server.Version}}'If you see docker.io, containerd and runc, you use Debian's packages. If you see docker-ce and containerd.io, you use Docker's own repository, which bundles containerd and runc and is updated by Docker; check those versions against Docker's release notes instead.
How to update
For Debian's packages:
sudo apt update
sudo apt install --only-upgrade docker.io containerd runcFor Docker's packages, a normal sudo apt update && sudo apt upgrade pulls the latest docker-ce, docker-ce-cli and containerd.io. If you want to switch, Docker's Debian install guide lists the distribution packages to remove first (docker.io, docker-compose, docker-doc, docker-buildx, podman-docker, containerd, runc); images and volumes in /var/lib/docker are kept, but plan and test the change. Do not mix the two sources.
Restart or reboot?
No reboot. The daemons must restart to load the fix. By default, as Docker's live restore page explains, running containers shut down when the Docker daemon stops, and only containers with a restart policy come back on their own, so schedule it:
sudo systemctl restart containerd dockerReduce your exposure
Most of these bugs need a malicious image, Dockerfile, BuildKit frontend or container. Docker's security documentation also says only trusted users should control the Docker daemon. Pull images from sources you trust, pin them by digest, do not add untrusted users to the docker group or expose the Docker API on the network, and keep build hosts separate from production where you can.
Sources
- security-tracker.debian.org/tracker/DSA-6443-1
- debian.org/security/2026/dsa-6443
- lists.debian.org/debian-security-announce/2026/msg00354.html
- security-tracker.debian.org/tracker/DSA-6067-1
- debian.org/security/2025/dsa-6067
- lists.debian.org/debian-security-announce/2025/msg00233.html
- security-tracker.debian.org/tracker/source-package/docker.io
- security-tracker.debian.org/tracker/source-package/containerd
- security-tracker.debian.org/tracker/source-package/runc
- github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2
- github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2
- github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp
- cve.org/CVERecord?id=CVE-2026-34040
- cve.org/CVERecord?id=CVE-2026-33747
- cve.org/CVERecord?id=CVE-2024-25621
- cve.org/CVERecord?id=CVE-2025-31133
- cve.org/CVERecord?id=CVE-2026-53488
- packages.debian.org/trixie/docker.io
- docs.docker.com/engine/install/debian
- docs.docker.com/engine/security
- cisa.gov/known-exploited-vulnerabilities-catalog
- docs.docker.com/engine/daemon/live-restore
Comments
0 total · 0 threads