Skip to main content
CVE-2026-31431VulnerabilityPublished Updated

SUSE · Security update for docker

Affects SUSESource GCVE Database

0

Mentioned vulnerabilities

Exploited in the wild · KEV due 15 May 2026 · public exploit available (Metasploit) · 98% EPSS : apply the vendor's fix or mitigations to SUSE now.

Data as of 26 Oct 2026, 16:39 UTC

Exploitation

Actively exploited

High severity · No CVSS score from NVD or the CNA

KEV deadline
 US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
EPSS
98.1% chance of exploitation in 30 days – higher than 99% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

  1. Disclosed: evidence found.

    CVE published 23 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: evidence found.

    1 Metasploit module

  4. Exploited in the wild: evidence found.

    Listed in CISA KEV 175 days before disclosure

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

Timeline

  1. Added to CISA KEV (opens in a new tab)

    exploitation confirmed

    , 175 days before disclosure

  2. KEV remediation due

    US federal deadline

    , 161 days before disclosure

  3. CVE published

    on cve.org

    , t = 0

  4. In Threat Radar

    record ingested

    , 3 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Description

This update for docker fixes the following issues: Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265782). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266625). - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262346). - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into that container (bsc#1267827). Non security issue fixed: - SELinux CIL files are not shipped in Docker (bsc#1278193). Changes for docker: - Update to Docker 29.7.2. See upstream changelog online at <https://docs.docker.com/engine/release-notes/29/#2972> fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176) - Update to buildx 0.36.1. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.36.1>

References

Community reviews

Loading reviews…