UpHeron
All vulnerabilities

Servers and applications

CVE-2021-21285

Docker daemon crash during image pull of malicious image

Severity
Medium 6.5
Published
2 Feb 2021
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
19.03.15, 20.10.3
Also known as
GHSA-6fj5-m822-rqx8
Sources
NVD, Project advisories (GitHub)

Description

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

Affected software

SoftwareAffected versions
Docker EngineServers and applications · cpe:a:docker:docker
  • Every version before 19.03.15
  • From 20.0.0 before 20.10.3
Docker EngineServers and applications · github:moby/moby
  • Every version before 20.10.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-21285
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-21285
  • GitHub Advisory Database https://github.com/advisories/GHSA-6fj5-m822-rqx8
  • github.com https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8