CVE-2024-24557: Classic builder cache poisoning in github.com/docker/docker
Summary
CVE-2024-24557: Classic builder cache poisoning in github.com/docker/docker. Affects github.com/docker/docker across 2 version ranges.
< 24.0.9+incompatible
>= 25.0.0+incompatible, < 25.0.2+incompatible
Fixed in 24.0.9+incompatible or 25.0.2+incompatible, depending on the release line you run. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2024-24557 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/docker/docker, an open-source project written in Go. It is a popular containerization platform that allows users to automate the deployment and management of applications within containers. Docker provides a set of tools and APIs for building, distributing, and running containers. It is widely used in the software development and deployment process.
Vulnerability Detail
The vulnerability identified as CVE-2024-24557 is a classic builder cache poisoning issue in github.com/docker/docker. This vulnerability allows an attacker to manipulate the builder cache, leading to potential security breaches and unauthorized access to sensitive information. By exploiting this vulnerability, an attacker can inject malicious code or modify the cache, which may result in the execution of arbitrary commands or unauthorized access to containerized applications and their underlying systems.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 24.0.9+incompatible24.0.9+incompatiblego get github.com/docker/docker@v24.0.9+incompatible -
>= 25.0.0+incompatible, < 25.0.2+incompatible25.0.2+incompatiblego get github.com/docker/docker@v25.0.2+incompatible
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to apply the recommended fix by updating the package to the patched versions.
Conclusion
In conclusion, the github.com/docker/docker package is susceptible to a classic builder cache poisoning vulnerability. This vulnerability can lead to unauthorized access, code execution, and potential security breaches. It is crucial to update the package to the recommended versions to mitigate the risk. Users should also follow best practices for securing their Docker installations and regularly update to the latest available versions.
See every vulnerability recorded for github.com/docker/docker →
FAQ
This vulnerability can lead to unauthorized access, code execution, and potential security breaches in containerized applications and underlying systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
At the time of this report, there are no known public exploits available for this vulnerability. However, it is crucial to apply the recommended fix to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected Docker installation is exposed to the internet without proper security measures.
For more detailed information about this vulnerability, you can refer to the vulnerability report at https://pkg.go.dev/vuln/GO-2024-2512.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
