Moby 29.9.3 and BuildKit v0.34.2: Fixes Swarm Overlay Encryption

Swarm Overlay Networks and Manager Certificates #

The release notes present the Swarm problem as a fix for missing protections on overlay networks, with firewalld flushing Docker's iptables rules as the trigger. The entry is GHSA-6jhp-7446-hf7f, and the release describes it as follows:

"Fix missing encryption and spoofing protections for Swarm overlay networks after firewalld flushes Docker's iptables rules" (Release v29.9.3)

Any Swarm cluster whose nodes run firewalld alongside Docker falls under this line, because firewalld is the component named as flushing the rules. This suggests that nodes without firewalld are not on the trigger path the note describes. Upgrading to 29.9.3 is the change the release lists for the overlay protections.

A SwarmKit update in the same release fixes CVE-2026-115539 (GHSA-628g-hv7f-pgjc). The note says an attacker with a valid worker-node TLS certificate and private key could obtain a manager-node certificate shortly after a Swarm leader change. This suggests that worker-node credentials remain a risk for a period after a leader change, so the upgrade matters for manager-node certificate exposure as well as for the overlay fix.

BuildKit v0.34.2: Git Resolver Cache and Control API File Attributes #

The release updates BuildKit to v0.34.2 and lists two advisories it fixes. GHSA-2fqp-xg6f-v7gj covers a build that resolved metadata for the same Git source reference twice, which could crash the daemon through resolver cache poisoning. Builds that reuse Git source references are the workload this entry concerns, and the fix is the BuildKit version change in the same release.

GHSA-w26x-xg27-7qjc covers a malicious client with access to the BuildKit control APIs, which could set extended attributes on files outside the BuildKit state directory. The release states that this could grant elevated privileges to programs on the host. This suggests that the risk depends on who can reach the control APIs, so limiting that access is part of the review for this release.

Applications Parsing Untrusted JWKs or zstd Input #

The release lists CVE-2026-116587 (GHSA-mgcc-cww5-fp2q) as possible excessive CPU usage when parsing crafted RSA keys, and CVE-2026-116591 (GHSA-fpmh-frq8-7rj8) as a possible panic when decompressing zstd data. The CVE records place these flaws in the go-jose and klauspost compress libraries. The RSA record says that on Go 1.24 and later, crafted large or degenerate RSA parameters can make validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources.

The zstd record describes a crafted two-block frame that can panic the decoder and crash an application that handles untrusted zstd input. CISA's SSVC assessment on 2026-10-27 rates exploitation of the zstd flaw as none. The release notes do not name the Docker component that uses these two libraries, so the exposure depends on whether your applications or Docker builds handle untrusted JWKs or zstd data.

Affected and Fixed Versions by Component #

Also in this release #

• Fixes literal << keys in YAML files being emitted without quotes (docker/cli#7461).
• Fixes the daemon hanging on container, image, and system API requests under load (moby/moby#54041).
• Complete list in the Release v29.9.3 notes, with the docker/cli and moby/moby 29.9.3 milestones.

Upgrade Steps for Engine, BuildKit and Application Libraries #

1. Move Docker Engine to 29.9.3, the release that lists CVE-2026-115538, CVE-2026-115539, CVE-2026-116587 and CVE-2026-116591 as fixed.
2. Confirm that BuildKit is v0.34.2, the version the release updates BuildKit to.
3. In Go applications that parse JWKs from untrusted sources, update go-jose to 4.1.6.
4. In Go applications that decompress zstd data from untrusted sources, update klauspost compress to 1.20.2.
5. On Swarm nodes that run firewalld with Docker, include them in the Engine upgrade to 29.9.3.

Checking Docker Engine, BuildKit and Library Versions #

On each host, compare the installed Docker Engine version with 29.9.3 and the BuildKit version with v0.34.2. For the libraries, search your Go module dependencies for go-jose and klauspost compress, then compare them with 4.1.6 and 1.20.2, since the CVE records treat older versions as affected. On Swarm nodes, check whether firewalld is running, because the advisory's trigger is firewalld flushing Docker's iptables rules.