diff --git a/content/manuals/engine/release-notes/29.md b/content/manuals/engine/release-notes/29.md index 671144b9f9..aaee8dda46 100644 --- a/content/manuals/engine/release-notes/29.md +++ b/content/manuals/engine/release-notes/29.md @@ -22,6 +22,42 @@ For more information about: - Deprecated and removed features, see [Deprecated Engine Features](../deprecated.md). - Changes to the Engine API, see [Engine API version history](/reference/api/engine/version-history/). +## 29.9.3 + +{{< release-date date="2026-11-03" >}} + +For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones: + +- [docker/cli, 29.9.3 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A29.9.3) +- [moby/moby, 29.9.3 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A29.9.3) + +### Security + +This release includes fixes for multiple security vulnerabilities affecting Docker Engine and related components. + +- **CVE-2026-116587** Fix possible excessive CPU usage when parsing crafted RSA keys + [GHSA-mgcc-cww5-fp2q](https://github.com/advisories/GHSA-mgcc-cww5-fp2q) +- **CVE-2026-116591** Fix a possible panic when decompressing zstd data + [GHSA-fpmh-frq8-7rj8](https://github.com/advisories/GHSA-fpmh-frq8-7rj8) +- **CVE-2026-115538** Fix missing encryption and spoofing protections for Swarm overlay networks after firewalld flushes Docker's iptables rules + [GHSA-6jhp-7446-hf7f](https://github.com/moby/moby/security/advisories/GHSA-6jhp-7446-hf7f) + +The SwarmKit update fixes the following security vulnerability: + +- **CVE-2026-115539** Fix a vulnerability where an attacker with a valid worker-node TLS certificate and private key could obtain a manager-node certificate shortly after a Swarm leader change + [GHSA-628g-hv7f-pgjc](https://github.com/moby/swarmkit/security/advisories/GHSA-628g-hv7f-pgjc) + +The [BuildKit v0.34.2 update](https://github.com/moby/buildkit/releases/tag/v0.34.2) fixes the following security vulnerabilities: + +- [GHSA-2fqp-xg6f-v7gj](https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj): A build that resolved metadata for the same Git source reference twice could crash the daemon through resolver cache poisoning. +- [GHSA-w26x-xg27-7qjc](https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc): A malicious client with access to the BuildKit control APIs could set extended attributes on files outside the BuildKit state directory, potentially granting elevated privileges to programs on the host. + +### Bug fixes and enhancements + +- Fix literal `<<` keys in YAML files being emitted without quotes. [docker/cli#7461](https://github.com/docker/cli/pull/7461) +- Fix the daemon hanging on container, image, and system API requests under load. [moby/moby#54041](https://github.com/moby/moby/pull/54041) +- Update BuildKit to [v0.34.2](https://github.com/moby/buildkit/releases/tag/v0.34.2). [moby/moby#54107](https://github.com/moby/moby/pull/54107) + ## 29.9.2 {{< release-date date="2026-10-20" >}} diff --git a/hugo.yaml b/hugo.yaml index f5d9edafb2..1d8bc2be98 100644 --- a/hugo.yaml +++ b/hugo.yaml @@ -180,10 +180,10 @@ params: # Latest version of the Docker Engine API latest_engine_api_version: "1.56" # Latest version of Docker Engine - docker_ce_version: "29.8.2" + docker_ce_version: "29.9.3" # Previous version of the Docker Engine # (Used to show e.g., "latest" and "latest"-1 in engine install examples - docker_ce_version_prev: "29.8.1" + docker_ce_version_prev: "29.9.2" # Latest Docker Compose version compose_version: "v5.6.0" # Latest BuildKit version