CVE-2026-92543

Name	CVE-2026-92543
Description	Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
docker.io (PTS)	bookworm	20.10.24+dfsg1-1+deb12u1	vulnerable
	trixie (security), trixie	26.1.5+dfsg1-9+deb13u1	vulnerable
	forky, sid	28.5.2+dfsg4-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
docker.io	source	(unstable)	(unfixed)

https://github.com/moby/moby/security/advisories/GHSA-7cfq-22r6-qp73