{"id":"CVE-2021-21285","aliases":["GHSA-6fj5-m822-rqx8"],"title":"moby docker daemon crash during image pull of malicious image","summary":"moby docker daemon crash during image pull of malicious image","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendor":"moby","product":"github.com/moby/moby","ecosystem":"go","affected":["github.com/moby/moby < 19.3.15","github.com/moby/moby >= 20.10.0-beta1, < 20.10.3"],"patched":["github.com/moby/moby 19.3.15","github.com/moby/moby 20.10.3"],"published":"2024-01-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:04.797788419Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6fj5-m822-rqx8","references":[{"url":"https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21285"},{"url":"https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30"},{"url":"https://docs.docker.com/engine/release-notes/#20103"},{"url":"https://github.com/moby/moby/releases/tag/v19.03.15"},{"url":"https://github.com/moby/moby/releases/tag/v20.10.3"},{"url":"https://security.gentoo.org/glsa/202107-23"},{"url":"https://security.netapp.com/advisory/ntap-20210226-0005"},{"url":"https://www.debian.org/security/2021/dsa-4865"}],"tags":["osv","go"],"epss":0.03287,"epssPercentile":0.87926,"ingestedAt":"2026-07-09T18:56:35.988Z","slug":"CVE-2021-21285","body":"## Overview\n\n### Impact\n\nPulling an intentionally malformed Docker image manifest crashes the `dockerd` daemon.\n\n### Patches\n\nVersions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.\n\n### Credits\n\nMaintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.\n\n## Affected packages\n\n- `github.com/moby/moby < 19.3.15`\n- `github.com/moby/moby >= 20.10.0-beta1, < 20.10.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/moby/moby 19.3.15`\n- `github.com/moby/moby 20.10.3`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.7,"exploitation":0,"ransomware":0},"changes":[]}