openSUSE-SU-2026:21205-1: important: Security update for docker-stable

openSUSE security update: security update for docker-stable
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21205-1
Rating: important
References:

  * bsc#1260279
  * bsc#1265782
  * bsc#1265907
  * bsc#1265929
  * bsc#1266625
  * bsc#1267827



Cross-References:

  * CVE-2026-33186
  * CVE-2026-33814
  * CVE-2026-33997
  * CVE-2026-34040
  * CVE-2026-39821
  * CVE-2026-41567



CVSS scores:

  * CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-33997 ( SUSE ): 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
  * CVE-2026-34040 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
  * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-39821 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-41567 ( SUSE ): 7.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 6 vulnerabilities and has 6 bug fixes can now be installed.

Description:

This update for docker-stable fixes the following issues

- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
  header (bsc#1260279).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
  (bsc#1265782).
- CVE-2026-33997: moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation
  (bsc#1265907).
- CVE-2026-34040: Authz zero length regression (bsc#1265929).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
  bypass and privilege escalation (bsc#1266625).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
  that container (bsc#1267827).


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1129=1

Package List:

- openSUSE Leap 16.0:

  docker-stable-24.0.9_ce-160000.6.1
  docker-stable-bash-completion-24.0.9_ce-160000.6.1
  docker-stable-buildx-0.25.0-160000.6.1
  docker-stable-fish-completion-24.0.9_ce-160000.6.1
  docker-stable-rootless-extras-24.0.9_ce-160000.6.1
  docker-stable-zsh-completion-24.0.9_ce-160000.6.1

References:

  * https://www.suse.com/security/cve/CVE-2026-33186.html
  * https://www.suse.com/security/cve/CVE-2026-33814.html
  * https://www.suse.com/security/cve/CVE-2026-33997.html
  * https://www.suse.com/security/cve/CVE-2026-34040.html
  * https://www.suse.com/security/cve/CVE-2026-39821.html
  * https://www.suse.com/security/cve/CVE-2026-41567.html