Docker Engine contains a vulnerability in its handling of insecure registries where a DNS response containing both a loopback IP and a non-loopback attacker IP can bypass certificate verification and enable HTTP fallback. This occurs because the insecure registry check uses an any-match DNS approach that considers a hostname insecure if any resolved address matches an insecure CIDR, but the transport reconnects using the hostname rather than the matched address. This flaw is fixed in Docker Engine version 18.09.0-355.oe2203sp4.