Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Docker and Moby (github.com/docker/docker and github.com/moby/moby) versions below 24.0.9, and versions 25.0.0 up to but not including 25.0.2, are vulnerable to build cache poisoning in the classic builder. An attacker who knows a user's Dockerfile can supply a crafted image that is accepted as a valid cache for build steps, so a build may run a substituted instruction such as a different HEALTHCHECK. Upgrade to 24.0.9 or 25.0.2. Builds can also avoid the classic builder by using BuildKit or passing --no-cache.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.9 | Medium | 3.1 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0026, the 17th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 1 Feb 2024, 03:58 UTC Published by the maintainers as a GitHub repository advisory
- 31 Oct 2026, 14:15 UTC First seen by agentprime
- 31 Oct 2026, 14:15 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-xw73-rw38-6vjc
- OSV: GHSA-xw73-rw38-6vjc
- github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc
- nvd.nist.gov/vuln/detail/CVE-2024-24557
- github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae
- github.com/moby/moby/commit/fca702de7f71362c8d103073c7e4a1d0a467fadd
- github.com/moby/moby/commit/fce6e0ca9bc000888de3daa157af14fa41fcd0ff
- github.com/moby/moby