engine: 29.9.3

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

content/manuals/engine/release-notes/29.md

@@ -22,6 +22,42 @@ For more information about:
 - Deprecated and removed features, see [Deprecated Engine Features](../deprecated.md).
 - Changes to the Engine API, see [Engine API version history](/reference/api/engine/version-history/).
 
+## 29.9.3
+
+{{< release-date date="2026-11-03" >}}
+
+For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:
+
+- [docker/cli, 29.9.3 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.9.3)
+- [moby/moby, 29.9.3 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.9.3)
+
+### Security
+
+This release includes fixes for multiple security vulnerabilities affecting Docker Engine and related components.
+
+- **CVE-2026-116587** Fix possible excessive CPU usage when parsing crafted RSA keys  
+  [GHSA-mgcc-cww5-fp2q](https://github.com/advisories/GHSA-mgcc-cww5-fp2q)
+- **CVE-2026-116591** Fix a possible panic when decompressing zstd data  
+  [GHSA-fpmh-frq8-7rj8](https://github.com/advisories/GHSA-fpmh-frq8-7rj8)
+- **CVE-2026-115538** Fix missing encryption and spoofing protections for Swarm overlay networks after firewalld flushes Docker's iptables rules  
+  [GHSA-6jhp-7446-hf7f](https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f)
+
+The SwarmKit update fixes the following security vulnerability:
+
+- **CVE-2026-115539** Fix a vulnerability where an attacker with a valid worker-node TLS certificate and private key could obtain a manager-node certificate shortly after a Swarm leader change  
+  [GHSA-628g-hv7f-pgjc](https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc)
+
+The [BuildKit v0.34.2 update](https://github.com/moby/buildkit/releases/tag/v0.34.2) fixes the following security vulnerabilities:
+
+- [GHSA-2fqp-xg6f-v7gj](https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj): A build that resolved metadata for the same Git source reference twice could crash the daemon through resolver cache poisoning.  
+- [GHSA-w26x-xg27-7qjc](https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc): A malicious client with access to the BuildKit control APIs could set extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host.  
+
+### Bug fixes and enhancements
+
+- Fix literal `<<` keys in YAML files being emitted without quotes. [docker/cli#7461](https://github.com/docker/cli/pull/7461)
+- Fix the daemon hanging on container, image, and system API requests under load. [moby/moby#54041](https://github.com/moby/moby/pull/54041)
+- Update BuildKit to [v0.34.2](https://github.com/moby/buildkit/releases/tag/v0.34.2). [moby/moby#54107](https://github.com/moby/moby/pull/54107)
+
 ## 29.9.2
 
 {{< release-date date="2026-10-20" >}}

hugo.yaml

@@ -180,10 +180,10 @@ params:
   # Latest version of the Docker Engine API
   latest_engine_api_version: "1.56"
   # Latest version of Docker Engine
-  docker_ce_version: "29.8.2"
+  docker_ce_version: "29.9.3"
   # Previous version of the Docker Engine
   # (Used to show e.g., "latest" and "latest"-1 in engine install examples
-  docker_ce_version_prev: "29.8.1"
+  docker_ce_version_prev: "29.9.2"
   # Latest Docker Compose version
   compose_version: "v5.6.0"
   # Latest BuildKit version