Security update for docker-compose
This security update for docker-compose addresses multiple vulnerabilities including credential leakage to telemetry endpoints, denial of service in SSH key exchange, an infinite loop in HTTP/2 transport, and a validation bypass leading to privilege escalation. These issues affect components such as buildx, golang.org/x/crypto/ssh, golang.org/x/net/http2, and golang.org/x/net/idna. The update fixes these high-severity vulnerabilities to improve the security posture of docker-compose deployments.
AI Analysis
Technical Summary
The update for docker-compose fixes four vulnerabilities: CVE-2025-0495 involves credential leakage to telemetry endpoints when credentials are set as attribute values in cache-to/cache-from configurations; CVE-2025-22869 is a denial of service vulnerability in the key exchange mechanism of golang.org/x/crypto/ssh; CVE-2026-33814 causes an infinite loop in HTTP/2 transport when given a malformed SETTINGS_MAX_FRAME_SIZE; CVE-2026-39821 allows validation bypass and privilege escalation due to failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna. These vulnerabilities affect the docker-compose environment and its dependencies, and the update addresses these issues.
Potential Impact
The vulnerabilities could lead to unauthorized credential exposure, denial of service conditions, infinite loops causing resource exhaustion, and privilege escalation due to validation bypass. These impacts can compromise confidentiality, availability, and integrity of systems running docker-compose if unpatched.
Mitigation Recommendations
A security update for docker-compose has been released that fixes these vulnerabilities. Users should apply the update promptly to remediate these issues. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the SUSE Product Security Team advisory for the official patch and remediation details.
Security update for docker-compose
Description
This security update for docker-compose addresses multiple vulnerabilities including credential leakage to telemetry endpoints, denial of service in SSH key exchange, an infinite loop in HTTP/2 transport, and a validation bypass leading to privilege escalation. These issues affect components such as buildx, golang.org/x/crypto/ssh, golang.org/x/net/http2, and golang.org/x/net/idna. The update fixes these high-severity vulnerabilities to improve the security posture of docker-compose deployments.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The update for docker-compose fixes four vulnerabilities: CVE-2025-0495 involves credential leakage to telemetry endpoints when credentials are set as attribute values in cache-to/cache-from configurations; CVE-2025-22869 is a denial of service vulnerability in the key exchange mechanism of golang.org/x/crypto/ssh; CVE-2026-33814 causes an infinite loop in HTTP/2 transport when given a malformed SETTINGS_MAX_FRAME_SIZE; CVE-2026-39821 allows validation bypass and privilege escalation due to failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna. These vulnerabilities affect the docker-compose environment and its dependencies, and the update addresses these issues.
Potential Impact
The vulnerabilities could lead to unauthorized credential exposure, denial of service conditions, infinite loops causing resource exhaustion, and privilege escalation due to validation bypass. These impacts can compromise confidentiality, availability, and integrity of systems running docker-compose if unpatched.
Mitigation Recommendations
A security update for docker-compose has been released that fixes these vulnerabilities. Users should apply the update promptly to remediate these issues. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the SUSE Product Security Team advisory for the official patch and remediation details.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- openSUSE-SU-2026:21247-1
- Cve Count
- 4
- Additional Cves
- ["CVE-2025-22869","CVE-2026-33814","CVE-2026-39821"]
Threat ID: 6aab496f55bf5e2cf5990e04
Added to database: 09/17/2026, 01:59:11 UTC
Last enriched: 09/17/2026, 02:15:04 UTC
Last updated: 09/17/2026, 02:15:04 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.