Explicitly reject multiple JSON documents in authentication payloads
instead of silently ignoring them. This helps notify users when the
authentication payload is incorrectly formatted.
Signed-off-by: hiroto.toyoda <hiroto.toyoda@dena.com>
Pull request 50956 (88adc28731) updated
various types in the API module from a string to a `netip.Prefix` or
`netip.Addr`. A side-effect of this was that zero values would no longer
be omitted, and instead marshaled as an empty string;
package main
import (
"encoding/json"
"fmt"
"net/netip"
)
type Foo struct {
OmitEmpty netip.Prefix `json:",omitempty"`
OmitZero netip.Prefix `json:",omitzero"`
}
func main() {
out, _ := json.Marshal(Foo{})
fmt.Println(string(out))
}
The above produces `{"OmitEmpty":""}`, not omitting the empty address.
This patch;
- updates most types to use `omitzero` instead of `omitempty`.
- adds explicit `json` names to fields.
There's one type remaining that uses `omitzero`, but it's generated by
go-swagger, which currently doesn't support `omitzero`; the `PortSummary.IP`;
335f60509f/api/types/container/port_summary.go (L12-L20)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add a definition for MountType, to make sure available options in
the enum don't diverge. In future we can use this definition to
generate the consts in code as well, but swagger doesn't currently
have an option to document the enum values.
Also using `allOf` to allow description and reference to be combined.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This releases includes 6 security fixes following the security policy:
- archive/zip: denial of service when parsing arbitrary ZIP archives
archive/zip used a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
Thanks to Thanks to Jakub Ciolek for reporting this issue.
This is CVE-2025-61728 and Go issue https://go.dev/issue/77102.
- net/http: memory exhaustion in Request.ParseForm
When parsing a URL-encoded form net/http may allocate an unexpected amount of
memory when provided a large number of key-value pairs. This can result in a
denial of service due to memory exhaustion.
Thanks to jub0bs for reporting this issue.
This is CVE-2025-61726 and Go issue https://go.dev/issue/77101.
- crypto/tls: Config.Clone copies automatically generated session ticket keys, session resumption does not account for the expiration of full certificate chain
The Config.Clone methods allows cloning a Config which has already been passed
to a TLS function, allowing it to be mutated and reused.
If Config.SessionTicketKey has not been set, and Config.SetSessionTicketKeys has
not been called, crypto/tls will generate random session ticket keys and
automatically rotate them. Config.Clone would copy these automatically generated
keys into the returned Config, meaning that the two Configs would share session
ticket keys, allowing sessions created using one Config could be used to resume
sessions with the other Config. This can allow clients to resume sessions even
though the Config may be configured such that they should not be able to do so.
Config.Clone no longer copies the automatically generated session ticket keys.
Config.Clone still copies keys which are explicitly provided, either by setting
Config.SessionTicketKey or by calling Config.SetSessionTicketKeys.
This issue was discoverd by the Go Security team while investigating another
issue reported by Coia Prant (github.com/rbqvq).
Additionally, on the server side only the expiration of the leaf certificate, if
one was provided during the initial handshake, was checked when considering if a
session could be resumed. This allowed sessions to be resumed if an intermediate
or root certificate in the chain had expired.
Session resumption now takes into account of the full chain when determining if
the session can be resumed.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2025-68121 and Go issue https://go.dev/issue/77113.
- cmd/go: bypass of flag sanitization can lead to arbitrary code execution
Usage of 'CgoPkgConfig' allowed execution of the pkg-config
binary with flags that are not explicitly safe-listed.
To prevent this behavior, compiler flags resulting from usage
of 'CgoPkgConfig' are sanitized prior to invoking pkg-config.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
for reporting this issue.
This is CVE-2025-61731 and go.dev/issue/77100.
- cmd/go: unexpected code execution when invoking toolchain
The Go toolchain supports multiple VCS which are used retrieving modules and
embedding build information into binaries.
On systems with Mercurial installed (hg) downloading modules (e.g. via go get or
go mod download) from non-standard sources (e.g. custom domains) can cause
unexpected code execution due to how external VCS commands are constructed.
On systems with Git installed, downloading and building modules with malicious
version strings could allow an attacker to write to arbitrary files on the
system the user has access to. This can only be triggered by explicitly
providing the malicious version strings to the toolchain, and does not affect
usage of @latest or bare module paths.
The toolchain now uses safer VCS options to prevent misinterpretation of
untrusted inputs. In addition, the toolchain now disallows module version
strings prefixed with a "-" or "/" character.
Thanks to splitline (@splitline) from DEVCORE Research Team for reporting this
issue.
This is CVE-2025-68119 and Go issue https://go.dev/issue/77099.
- crypto/tls: handshake messages may be processed at the incorrect encryption level
During the TLS 1.3 handshake if multiple messages are sent in records that span
encryption level boundaries (for instance the Client Hello and Encrypted
Extensions messages), the subsequent messages may be processed before the
encryption level changes. This can cause some minor information disclosure if a
network-local attacker can inject messages during the handshake.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2025-61730 and Go issue https://go.dev/issue/76443
View the release notes for more information:
https://go.dev/doc/devel/release#go1.25.6
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Clarify what the /images/{name}/tag endpoint does by explaining that
it creates an additional reference (tag) to the source image, and that
existing tags will be overwritten.
The previous description "Tag an image so that it becomes part of a
repository" was unclear about what the operation actually does.
Fixes#22402
Signed-off-by: majiayu000 <1835304752@qq.com>
Document that when a health check command exceeds its configured
timeout, the process is forcibly terminated. This clarifies the
behavior for users who need predictable handling of hung health
check commands.
Fixes#45927
Signed-off-by: majiayu000 <1835304752@qq.com>
The API documentation incorrectly stated that the Data field for
secrets and configs should use Base64-url-safe-encoded format
(RFC 4648 section 5). However, Docker actually uses standard base64
encoding (RFC 4648 section 4).
This caused confusion when users tried to use URL-safe base64 encoding
and received "illegal base64 data" errors.
Update the documentation to correctly reference RFC 4648 section 4
(standard base64) instead of section 5 (URL-safe base64).
Fixes#37671
Signed-off-by: majiayu000 <1835304752@qq.com>
Update the memory stats documentation to clarify differences between
cgroups v1 and v2:
- Add cgroups v2 formula for calculating used_memory using inactive_file
instead of cache field which is not available in v2
- Update memory_stats.stats description to explain that field names
differ between v1 (cache, rss, mapped_file) and v2 (file, anon, inactive_file)
Fixes#43810
Signed-off-by: majiayu000 <1835304752@qq.com>
The API documentation had incorrect descriptions for these fields:
- `/version` endpoint's `Arch` field was described generically but actually
returns the Go runtime's GOARCH value
- `/info` endpoint's `Architecture` field incorrectly stated it returns
GOARCH, but it actually returns the OS-reported hardware architecture
(equivalent to `uname -m`)
This commit corrects the descriptions to accurately reflect the
implementation.
Fixes#49594
Signed-off-by: majiayu000 <1835304752@qq.com>
types/swarm/task.go:151:2: structtag: struct field tag `json:MemorySwappiness,omitzero"` not compatible with reflect.StructTag.Get: bad syntax for struct tag value (govet)
MemorySwappiness *int64 `json:MemorySwappiness,omitzero"`
^
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Similar to caaa9c9bb5, but applied to
existing API versions, so that it's easier to compare differences
between versions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The /grpc and /session endpoints are now deprecated as the Engine has
been upgraded to properly support HTTP/2 and h2c requests, making these
specialized endpoints unnecessary.
These endpoints will be removed in the next major API version to
complete the cleanup.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
In a multi-module repository, the top-level LICENSE file is used for
all modules in the repository. However, when using a "replace" rule,
the vendored file is removed, but added back when removing the replace
rule.
This patch adds copies of the license to each of the modules to reduce
code-churn; these are vanilla copies downloaded from;
https://www.apache.org/licenses/LICENSE-2.0.txt
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
I recently had a great time to find out why the tmpfs mode provided did not work
until I found out that the API does not expect octal values but decimal ones.
Therefore, this PR will hopefully clarify the logic and prevent user questions in the future
Signed-off-by: Kai Harder <kai.harder@sap.com>
While go1.23 still works, it's already EOL, so it may be a better
starting point to use that as minimum version for these modules, as
they're brand new.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The docker documentation website may not be publishing rendered versions
of the swagger for deprecated API versions, so let's remove these links
from the changelog.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
