Docker Engine contains a vulnerability (CVE-2026-92543) where insecure registry hostnames are classified using an any-match DNS check. This flaw allows an attacker to bypass certificate verification and enable HTTP fallback by exploiting the way loopback and non-loopback IP addresses are handled during registry connections. A fix is available in Docker Engine version 18.09.0-358.oe2403sp3.