GO111MODULE=off was added when generation ran inside GOPATH with
vendor.mod workarounds. Generation now runs outside GOPATH, those
workarounds are gone, and tools are declared in go.mod, so keep module
mode enabled to resolve them through `go tool`.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Use grep's text mode when locating tests matching TEST_FILTER.
The search is restricted to *_test.go files, which are known to be text.
Using -I allowed grep's binary-file detection heuristic to silently ignore
matching source files, causing the corresponding integration test suites to
be skipped.
For example, grep may report a Go test file:
$ grep -nE 'func .*TestRunWriteSpecialFilesAndNotCommit.*' \
integration-cli/docker_cli_run_test.go
grep: integration-cli/docker_cli_run_test.go: binary file matches
Forcing text mode finds the expected test:
$ grep -anE 'func .*TestRunWriteSpecialFilesAndNotCommit.*' \
integration-cli/docker_cli_run_test.go
1713:func (s *DockerCLIRunSuite) TestRunWriteSpecialFilesAndNotCommit(c *testing.T) {
This caused TEST_FILTER not to find a test, and skipping all tests;
make TEST_FILTER=TestRunWriteSpecialFilesAndNotCommit test-integration
...
---> Making bundle: test-integration (in bundles/test-integration)
Skipping integration tests since the supplied filter "TestRunWriteSpecialFilesAndNotCommit" omits all integration tests
Skipping integration-cli tests since the supplied filter "TestRunWriteSpecialFilesAndNotCommit" omits all integration-cli tests
integration and integration-cli skipped according to env vars
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release includes a fix to address a breakage affecting unencrypted
HTTP/2 (h2c) connections caused by a security patch included in last
patch release.
See go.dev/issue/80876 for details.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This release includes 10 security fixes following the security policy:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging
up to two sumdb tiles that allow for a requested module
to bypass the GOSUMDB check and persist attacker-controlled
module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve
malicious module content that cannot be detected
by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.
- x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup
A malicious GOSUMDB was capable of serving arbitrary
module content not contained within the transparency
log.
This attack allows for a coordinating GOPROXY and
GOSUMDB to serve a client malicious module content
that cannot be detected by evaluating the transparency
log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.
- encoding/xml: add recursion depth guard during decode
Previously, DecodeElement would reset the depth counter
causing it to never fire; this could lead to stack
exhaustion.
This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.
net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check
When a server is configured to support unencrypted HTTP/2, it reads a
few bytes from each new connection to see if they contain the HTTP/2
client preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.
This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.
- net/url: avoid quadratic complexity in resolvePath
Previously, resolving relative paths containing parent directory (..) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
Now, path resolution operates on a byte buffer using index-based backtracking for .. segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.
- golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record
Parsing an invalid SVCB or HTTPS RR can panic when
the size of a parameter value overflows the message buffer.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.
- crypto/tls: limit handshake messages we are willing to accept post-handshake
Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.
Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.
- html/template: fix Javascript regexp context tracking
Previously, pathological inputs could close an
unescaped / early, allowing for attack-controlled
data to inject arbitrary content, potentially
leading to XSS.
Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.
- x/net/idna: failure to reject ASCII-only Punycode-encoded labels
The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels
that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com")
incorrectly returned the name "example.com" rather than an error.
The idna package implements the processing algorithm from UTS 46.
Older versions of UTS 46 included a specification bug which permitted
multiple ASCII labels to decode to the same Unicode label.
UTS 46 revision 33 fixed the specification bug.
The idna package now implements the updated specification.
This behavior can lead to privilege escalation in programs using the idna package.
For example, a program which performs privilege checks on the ASCII hostname
may reject "example.com" but permit "xn--example-.com". If that program subsequently
converts the ASCII hostname to Unicode, it will inadvertently permits access
to the Unicode name "example.com".
Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.
- encoding/asn1: enforce maximum recursion depth
Enforce a recursion limit in Unmarshal to prevent stack exhaustion
when parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwans...@gmail.com) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Windows pull requests did not stress-test new or modified integration
tests, so Windows-specific flakes could reach the regular test suite.
Add a standalone workflow that detects selected tests before starting
costly build work, then runs each test 10 times on Windows 2025. Start
dockerd with the containerd runtime and snapshotter backend so the check
covers the latest supported Windows configuration.
Share test detection and `/flaky-check=TestA,TestB` parsing with the
existing Linux flaky-test path so both platforms select tests with the
same rules.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The test suite is executed via "env -i" with an explicit allow-list of
environment variables, so DBUS_SESSION_BUS_ADDRESS (exported by
.integration-daemon-start in rootless-systemd mode) never reached the
test binaries, nor the daemons they spawn via internal/testutil/daemon
("sudo --preserve-env"). Without it, runc inside those daemons cannot
detect the systemd user manager ("busctl --user" fails with the
per-daemon XDG_RUNTIME_DIR), assumes a rootful systemd, and fails to
create the container scope on the system bus:
unable to start unit "docker-<id>.scope" ...: Permission denied
Also skip TestRunWithAlternativeContainerdShim in rootless-systemd
mode: the daemon only passes the SystemdCgroup option to the stock
runc runtime, so with an ad-hoc shim name runc falls back to the
cgroupfs driver and treats the systemd-style cgroupsPath as a literal
path, which cannot be created by a rootless daemon.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Previously, the rootless-systemd CI mode failed with:
open /sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers: no such file or directory
on every container start. The daemon auto-selects the systemd cgroup
driver (cgroup v2 + systemd detected), but the test harness launched
dockerd-rootless.sh via plain "sudo" with a fabricated XDG_RUNTIME_DIR,
so there was no systemd user session at all: no user-${uid}.slice, no
user@${uid}.service, and no user D-Bus socket for runc to talk to.
withRootless() (daemon/oci_linux.go) then failed reading the controllers
file at every container start.
Set up the environment the way it is documented for production rootless
installations instead:
- hack/make/.integration-daemon-start: when systemd is running, enable
lingering for unprivilegeduser (which starts user@${uid}.service),
use /run/user/${uid} as XDG_RUNTIME_DIR, and export
DBUS_SESSION_BUS_ADDRESS so that runc can find the systemd user
manager. The variable also propagates to the daemons spawned by the
test suite (sudo --preserve-env in internal/testutil/daemon), whose
XDG_RUNTIME_DIR points to a non-standard location.
- hack/dind-systemd: delegate the cpu/cpuset/io/memory/pids cgroup
controllers to unprivileged users, matching
https://docs.docker.com/engine/security/rootless/#limiting-resources
Fixes the "test (amd64, *, rootless-systemd)" CI failures tracked in
issue 44084.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
gotestsum enables color output for known CI environments by checking
whether CI is set first, then looking for a vendor-specific variable
(GITHUB_ACTIONS, GITLAB_CI, etc.).
GITHUB_ACTIONS was already forwarded into the test containers, but CI
was not, so the check was never reached and gotestsum fell back to
isatty, which returns no-color for the non-TTY pipes used inside Docker.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
go1.26.5 (released 2026-07-07) includes security fixes to the crypto/tls
and os packages, as well as bug fixes to the compiler, the runtime, the
go command, and the net, os, and syscall packages. See the Go 1.26.5
milestone on our issue tracker for details;
- https://github.com/golang/go/issues?q=milestone%3AGo1.26.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.26.4...go1.26.5
From the security announcement:
We have just released Go versions 1.26.5 and 1.25.12, minor point releases.
These releases include 2 security fixes following the security policy:
- os: Root escape via symlink plus trailing slash
On Unix systems, opening a file in an os.Root improperly
followed symlinks to locations outside of the Root when
the final path component of the a path is a symbolic link
and the path ends in /.
For example, root.Open("symlink/") would open "symlink"
even when "symlink" is a symbolic link pointing outside of the root.
On Unix, openat(fd, path, O_NOFOLLOW) will follow symlinks
in path when path ends in a /. Root failed to account for
this behavior, permitting paths with a trailing / to escape.
It now properly sanitizes the path parameter provided to openat.
hanks to Mundur for reporting this issue.
This is CVE-2026-39822 and Go issue https://go.dev/issue/79005.
- crypto/tls: Encrypted Client Hello privacy leak
he Encrypted Client Hello implementation would leak the pre-shared key
dentities during the handshake, allowing a passive network observer who can
ollect handshakes to de-anonymize the hostname of the server, even when ECH was
eing used.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
set_repeat_timeout is called inside run_test_integration, which is
itself invoked once per iteration by the repeat loop (TEST_REPEAT
times). Each call multiplied TIMEOUT by TEST_REPEAT again, so with
TEST_REPEAT=10 and TIMEOUT=10m the progression was:
iter 1: 100m, iter 2: 1000m, ..., iter 8: 1000000000m
Go's time.ParseDuration overflows on 1000000000m (≈ 6×10²² ns >
int64 max), producing:
invalid value "1000000000m" for flag -test.timeout: parse error
The multiplier (TEST_REPEAT) and the scaled value (100m) are both
correct; the problem is repeated application. Fix by moving the single
set_repeat_timeout call out of run_test_integration and into
hack/make/test-integration, directly before the repeat loop. That way
TIMEOUT is scaled exactly once regardless of how many iterations the
loop runs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Allows PR authors to stress-test specific integration tests for
flakiness even when the diff doesn't touch them.
Add a /flaky-check directive on its own line in the PR body:
/flaky-check=TestFoo,TestBar
The GHA integration-flaky job parses the directive from the PR body and
exports the names as FLAKY_EXTRA_TESTS, which the script appends to the
diff-detected set before running the stress loop.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The DCO job runs inside an Alpine container and fetches the base
branch from VALIDATE_REPO unless VALIDATE_ORIGIN_BRANCH is set.
In forked runs that repository can point at a private upstream URL, so
the unauthenticated fetch fails with:
```
fatal: could not read Username for 'https://github.com': No such
device or address
```
Pass the pull request base SHA so the validator can resolve the
comparison point locally.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Also run `test-integration-flaky` for changed existing tests.
Keep the old added-test detection as-is, and add modified-test detection
on top of it to avoid regressing the existing behavior.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Follow-up to 4210ba07d9, which added the
"tool" directive, but kept the existing package references, which means
that installation would potentially happen multiple times.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
GitHub issue and PR references in commit messages become part of
persistent history and can create unintended cross-references.
Check commit subjects and bodies for shorthand references such as
<hash>123, moby/moby<hash>123 and GitHub issue or pull-request URLs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The test was skipped because Container.run() returned stale container
state after 7bc56c5365 changed when the
short ID was added to Aliases. That behaviour is now stable and the
test passes against the current docker-py commit (059d371).
Signed-off-by: Rajnish Kumar <rajnishkumar448@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release include 3 security fixes following the security policy:
- mime: quadratic complexity in WordDecoder.DecodeHeader
Decoding a maliciously-crafted MIME header containing many invalid
encoded-words could consume excessive CPU.
The MIME decoder now better handles this case.
Thanks to p4p3r (https://hackerone.com/p4p3r_hak) for reporting this issue.
This is CVE-2026-42504 and Go issue https://go.dev/issue/79217.
- net/textproto: arbitrary input are included in errors without any escaping
When returning errors, functions in the net/textproto package would
include its input as part of the error, without any escaping. Note that
said input is often controlled by external parties when using this
package naturally. For example, a net/http client uses ReadMIMEHeader
when parsing the headers it receive from a server.
As a result, an attacker could inject arbitrary content into the error.
Practically, this can result in an attacker injecting misleading
content, terminal control bytes, etc. into a victim's output or logs.
This is CVE-2026-42507 and Go issue https://go.dev/issue/79346
- crypto/x509: split candidate hostname only once
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop
over all DNS Subject Alternative Name (SAN) entries. This caused
strings.Split(host, ".") to execute repeatedly on the same input hostname.
With a large DNS SAN list, verification costs scaled quadratically based on the
number of SAN entries multiplied by the hostname's label count. Because
x509.Verify validates hostnames before building the certificate chain, this
overhead occurred even for untrusted certificates.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-27145 and https://go.dev/issue/79694.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.26.4
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Split the diff from the grep in the bundle so a failed diff is no longer
swallowed and misreported as "no new tests".
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Sebastiaan van Stijn