An update for docker is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3526 Final 1.0 1.0 2026-08-30 Initial 2026-08-30 2026-08-30 openEuler SA Tool V1.0 2026-08-30 docker security update An update for docker is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4 Docker is a product for you to build, ship and run any application as a lightweight container. Security Fix(es): The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.(CVE-2026-17106) An update for docker is now available for openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High docker https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3526 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-17106 https://nvd.nist.gov/vuln/detail/CVE-2026-17106 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 docker-engine-18.09.0-276.oe2003sp4.aarch64.rpm docker-engine-18.09.0-351.oe2203sp4.aarch64.rpm docker-engine-debuginfo-18.09.0-351.oe2203sp4.aarch64.rpm docker-engine-debugsource-18.09.0-351.oe2203sp4.aarch64.rpm docker-engine-18.09.0-354.oe2403sp1.aarch64.rpm docker-engine-debuginfo-18.09.0-354.oe2403sp1.aarch64.rpm docker-engine-debugsource-18.09.0-354.oe2403sp1.aarch64.rpm docker-engine-18.09.0-354.oe2403sp3.aarch64.rpm docker-engine-debuginfo-18.09.0-354.oe2403sp3.aarch64.rpm docker-engine-debugsource-18.09.0-354.oe2403sp3.aarch64.rpm docker-engine-18.09.0-354.oe2403sp4.aarch64.rpm docker-engine-debuginfo-18.09.0-354.oe2403sp4.aarch64.rpm docker-engine-debugsource-18.09.0-354.oe2403sp4.aarch64.rpm docker-engine-18.09.0-276.oe2003sp4.src.rpm docker-engine-18.09.0-351.oe2203sp4.src.rpm docker-engine-18.09.0-354.oe2403sp1.src.rpm docker-engine-18.09.0-354.oe2403sp3.src.rpm docker-engine-18.09.0-354.oe2403sp4.src.rpm docker-engine-18.09.0-276.oe2003sp4.x86_64.rpm docker-engine-18.09.0-351.oe2203sp4.x86_64.rpm docker-engine-debuginfo-18.09.0-351.oe2203sp4.x86_64.rpm docker-engine-debugsource-18.09.0-351.oe2203sp4.x86_64.rpm docker-engine-18.09.0-354.oe2403sp1.x86_64.rpm docker-engine-debuginfo-18.09.0-354.oe2403sp1.x86_64.rpm docker-engine-debugsource-18.09.0-354.oe2403sp1.x86_64.rpm docker-engine-18.09.0-354.oe2403sp3.x86_64.rpm docker-engine-debuginfo-18.09.0-354.oe2403sp3.x86_64.rpm docker-engine-debugsource-18.09.0-354.oe2403sp3.x86_64.rpm docker-engine-18.09.0-354.oe2403sp4.x86_64.rpm docker-engine-debuginfo-18.09.0-354.oe2403sp4.x86_64.rpm docker-engine-debugsource-18.09.0-354.oe2403sp4.x86_64.rpm The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process. 2026-08-30 CVE-2026-17106 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 High 7.1 AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N docker security update 2026-08-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3526