Ambiguous OCI Manifest Parsing Vulnerability in Moby (Docker Engine)
Summary
GHSA-xmmx-7jpf-fx42: Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing. Affects github.com/docker/docker versions < 20.10.11. Fixed in 20.10.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moby, also known as Docker Engine, is an open-source containerization platform that allows developers to build, package, and distribute applications as lightweight containers. It provides an API and command-line interface for managing containers and their dependencies. Moby is written in Go and is widely used in the software development industry.
Vulnerability Detail
The Ambiguous OCI Manifest Parsing vulnerability affects Moby (Docker Engine) versions prior to 20.10.11. In the OCI Distribution Specification and OCI Image Specification, manifest and index documents can be ambiguous without an accompanying Content-Type HTTP header. Moby treats the Content-Type header as trusted and deserializes the document accordingly. However, if the Content-Type header changes between pulls of the same ambiguous document with the same digest, the document may be interpreted differently. This means that relying solely on the digest is insufficient to unambiguously identify the content of the image. An attacker could potentially exploit this vulnerability to manipulate the interpretation of the image content, leading to unauthorized access, data leakage, or other security breaches.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.10.11
This is the first release that contains the fix.
go get github.com/docker/docker@v20.10.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to only pull images from trusted sources. By ensuring that the images come from reputable and verified sources, the risk of exploitation through this vulnerability can be reduced.
Conclusion
The Ambiguous OCI Manifest Parsing vulnerability in Moby (Docker Engine) can be mitigated by updating to version 20.10.11 or later. It is important to promptly address this vulnerability to prevent potential security breaches. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Moby, also known as Docker Engine, is an open-source containerization platform used for building, packaging, and distributing applications as containers.
The vulnerability allows for ambiguous interpretation of image content, potentially leading to unauthorized access, data leakage, or other security breaches.
To fix this vulnerability, update Moby (Docker Engine) to version 20.10.11 or later.
As a temporary workaround, only pull images from trusted sources to reduce the risk of exploitation.
For more information, refer to the GitHub security advisories: https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m and https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
