StackPrism

Infrastructure

Docker: supported versions and open vulnerabilities today

Docker 29 and 25.0 are supported (25.0 until Dec 4, 2026); 28 reached end of life on May 13, 2026; the latest release is 29.9.1. 3 high or critical advisories for Docker were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.

Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.

Check my repoDesign a stack with Docker
Latest release
29.9.1
GitHub stars
72.2k
Licence
Apache-2.0
OpenSSF Scorecard
9.1 / 10

Supported versions

Data: endoflife.date
Docker release lines and security support dates from endoflife.date
VersionSecurity supportLatestReleased
Docker 29Supported: No end date announced29.9.1
Docker 25.0Ending soon: Until 25.0.18
Docker 28Ended: Ended 28.5.2
Docker 27Ended: Ended 27.5.1
Docker 26.1Ended: Ended 26.1.5

Security advisories

OSV.dev, CISA KEV and FIRST EPSS

5 advisories published in the last 12 months, 3 of them high or critical. 42 in total since records began. Checked packages: github.com/docker/docker and github.com/moby/moby.

  • HighCVE-2026-42306Published

    Docker: Race condition in docker cp allows bind mount redirection to host path

    No fixed version listed yet.

    Affects github.com/docker/docker and github.com/moby/moby.

    EPSS: top 100%
  • HighCVE-2026-41567Published

    Docker: `PUT /containers/{id}/archive` executes container binary on the host

    No fixed version listed yet.

    Affects github.com/docker/docker and github.com/moby/moby.

    EPSS: top 96%
  • HighCVE-2026-34040Published

    Moby has AuthZ plugin bypass when provided oversized request bodies

    Fixed in 29.3.1.

    Affects github.com/moby/moby and github.com/docker/docker.

    EPSS: top 95%

All github.com/docker/docker advisories on OSV.devAll github.com/moby/moby advisories on OSV.dev

Maintenance and supply chain

OpenSSF Scorecard 9.1 / 10 (scored )

The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 3 issue updates found in the last 90 days.

Weakest checks

  • Unpinned build dependencies (Pinned-Dependencies 4/10)

Full ScorecardSource repository

Production checklist

Docker production checklist: 5 checks before launch

  • Must do: Don’t bake secrets into images; use build secrets and runtime env
  • Should do: Run as a non-root user and pin base image versions
  • Should do: Add a .dockerignore that excludes .env, .git and local build output
See all 5 checks with how to verify each

Alternatives

  • Kubernetes

    Industry-standard container orchestration platform

    Strengths

    • Largest ecosystem and community
    • Cloud-agnostic with multi-cloud support

    Trade-offs

    • Steep learning curve
    • Complex to operate
    Kubernetes health today

  • AWS ECS

    AWS-managed container orchestration service

    Strengths

    • Deep AWS integration
    • Fully managed (no control plane)

    Trade-offs

    • AWS vendor lock-in
    • Less portable than Kubernetes
    AWS ECS health today

  • Nomad

    HashiCorp's flexible workload orchestrator

    Strengths

    • Simpler than Kubernetes
    • Supports containers and non-containerized apps

    Trade-offs

    • Smaller community than Kubernetes
    • Less native cloud integrations

  • OpenShift

    Enterprise Kubernetes platform by Red Hat

    Strengths

    • Enterprise-grade Kubernetes with added features
    • Built-in CI/CD (pipelines, builds)

    Trade-offs

    • Red Hat ecosystem lock-in
    • Heavier resource requirements

Docs and release notes

Check Docker in your own stack

This page checks Docker in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.

Check my repoDesign a stack with Docker