CVE-2025-54410: github.com/docker/docker - Moby firewalld Reload Vulnerability
Summary
CVE-2025-54410: Moby firewalld reload removes bridge network isolation in github.com/docker/docker. Affects github.com/docker/docker versions < 28.0.0+incompatible. Fixed in 28.0.0+incompatible. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2025-54410 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/docker/docker package is a widely used library for building and managing Docker containers. It provides essential functionalities for containerization, including image management, networking, and orchestration. This package is integral to many applications that rely on containerized environments. However, it has been identified to have a vulnerability that compromises network isolation when using the firewalld service.
Vulnerability Detail
The vulnerability arises from the Moby firewalld reload process, which inadvertently removes bridge network isolation. This flaw can lead to unauthorized access to network resources, potentially exposing sensitive data and allowing malicious actors to exploit the network configuration. The issue is particularly critical in environments where network isolation is a key security measure.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
28.0.0+incompatible
This is the first release that contains the fix.
go get github.com/docker/docker@v28.0.0+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually configure your firewall rules to maintain network isolation while using the affected version of the package. This may involve adjusting iptables rules or using alternative network management tools to ensure that your container networks remain secure.
Conclusion
The CVE-2025-54410 vulnerability in the github.com/docker/docker package poses a significant risk to network security by removing bridge network isolation. It is crucial to update to the patched version to mitigate this risk and ensure the integrity of your applications.
See every vulnerability recorded for github.com/docker/docker →
FAQ
CVE-2025-54410 is a vulnerability in the github.com/docker/docker package that allows the firewalld reload process to remove bridge network isolation, potentially exposing network resources.
If your application relies on the github.com/docker/docker package for container management, this vulnerability could lead to unauthorized access to your network, compromising security.
If an immediate update is not possible, consider implementing manual firewall rules to maintain network isolation as a temporary workaround.
You can find more details about CVE-2025-54410 on the official Go vulnerability database at https://pkg.go.dev/vuln/GO-2025-3829.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. By simply using Gopkg.lock, Vulert provides insights without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
