CVE-2025-54388: Remote Access Vulnerability in github.com/docker/docker due to Moby Firewalld Reload
Summary
CVE-2025-54388: Moby firewalld reload makes published container ports accessible from remote hosts in github.com/docker/docker. Affects github.com/docker/docker versions >= 28.2.0+incompatible, < 28.3.3+incompatible. Fixed in 28.3.3+incompatible. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2025-54388 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/docker/docker package is a widely used library for building and managing Docker containers. It provides essential functionalities for container orchestration, image management, and networking. However, this package has a vulnerability that can expose published container ports to remote hosts, potentially leading to unauthorized access and security breaches.
Vulnerability Detail
The vulnerability arises from the Moby firewalld reload process, which fails to properly secure published container ports. When the firewalld service is reloaded, it inadvertently makes these ports accessible from remote hosts, allowing unauthorized users to connect to services running inside the containers. This could lead to data breaches, service disruptions, or exploitation of other vulnerabilities within the containerized applications.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
28.3.3+incompatible
This is the first release that contains the fix.
go get github.com/docker/docker@v28.3.3+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the published container ports by configuring your firewall rules to only allow connections from trusted IP addresses. This can be done using the following command:
firewall-cmd --zone=trusted --add-source=<trusted_ip_address> --permanent
After making changes, reload the firewall with
firewall-cmd --reload'.
Conclusion
The CVE-2025-54388 vulnerability in the github.com/docker/docker package poses significant security risks by exposing container ports to remote access. It is crucial to update to the patched version 28.3.3+incompatible or implement firewall restrictions to mitigate these risks effectively.
See every vulnerability recorded for github.com/docker/docker →
FAQ
CVE-2025-54388 is a vulnerability in the github.com/docker/docker package that allows published container ports to be accessed from remote hosts due to improper handling during the Moby firewalld reload process.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. This tool analyzes your Gopkg.lock file for known vulnerabilities without requiring any signup.
The risks include unauthorized access to containerized applications, potential data breaches, and exploitation of other vulnerabilities within the containers, leading to service disruptions.
Yes, the vulnerability has been patched in version 28.3.3+incompatible of the github.com/docker/docker package. It is recommended to update to this version or later.
If an immediate update is not possible, implement firewall rules to restrict access to the published container ports as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
