---
id: CVE-2021-21285
aliases:
  - GHSA-6fj5-m822-rqx8
title: moby docker daemon crash during image pull of malicious image
summary: moby docker daemon crash during image pull of malicious image
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: moby
product: github.com/moby/moby
ecosystem: go
affected:
  - github.com/moby/moby < 19.3.15
  - 'github.com/moby/moby >= 20.10.0-beta1, < 20.10.3'
patched:
  - github.com/moby/moby 19.3.15
  - github.com/moby/moby 20.10.3
published: '2024-01-31'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:04.797788419Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6fj5-m822-rqx8'
references:
  - url: 'https://github.com/moby/moby/security/advisories/GHSA-6fj5-m822-rqx8'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-21285'
  - url: >-
      https://github.com/moby/moby/commit/8d3179546e79065adefa67cc697c09d0ab137d30
  - url: 'https://docs.docker.com/engine/release-notes/#20103'
  - url: 'https://github.com/moby/moby/releases/tag/v19.03.15'
  - url: 'https://github.com/moby/moby/releases/tag/v20.10.3'
  - url: 'https://security.gentoo.org/glsa/202107-23'
  - url: 'https://security.netapp.com/advisory/ntap-20210226-0005'
  - url: 'https://www.debian.org/security/2021/dsa-4865'
tags:
  - osv
  - go
epss: 0.03287
epssPercentile: 0.87981
ingestedAt: '2026-07-09T18:56:35.988Z'
---

## Overview

### Impact

Pulling an intentionally malformed Docker image manifest crashes the `dockerd` daemon.

### Patches

Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

### Credits

Maintainers would like to thank Josh Larsen, Ian Coldwater, Duffie Cooley, Rory McCune for working on the vulnerability and Brad Geesaman for responsibly disclosing it to security@docker.com.

## Affected packages

- `github.com/moby/moby < 19.3.15`
- `github.com/moby/moby >= 20.10.0-beta1, < 20.10.3`

## Remediation

Upgrade to a patched release:

- `github.com/moby/moby 19.3.15`
- `github.com/moby/moby 20.10.3`