CVE catalog

CVE-2025-54388

docker.io: CVE-2025-54388

Severity: Medium · CVSS 5.2CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: Jul 30, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.25% · Oct 25, 2026

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	docker.io	sid	`28.5.2+dfsg4-5`	not affected
Debian	docker.io	forky	`28.5.2+dfsg4-5`	not affected
Debian	docker.io	trixie	`26.1.5+dfsg1-9+deb13u1`	not affected
Debian	docker.io	trixie-security	`26.1.5+dfsg1-9+deb13u1`	not affected
Debian	docker.io	bookworm	`20.10.24+dfsg1-1+deb12u1`	not affected
Opensuse	docker	leap 16.0	`28.5.1_ce-160000.4.1`	fixed
Opensuse	govulncheck-vulndb	tumbleweed	`0.0.20250811T192933-1.1`	fixed
Opensuse	docker	tumbleweed	`28.3.3_ce-26.1`	fixed
Suse	docker	linux enterprise server 16.0	`28.5.1_ce-160000.4.1`	fixed
Suse	docker	linux enterprise server for sap applications 16.0	`28.5.1_ce-160000.4.1`	fixed
Suse	docker	linux micro 6.0	`28.3.3_ce-6.1`	fixed
Suse	docker	linux enterprise micro 5.3	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise micro 5.4	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise micro 5.5	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise module for basesystem 15 sp7	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise module for containers 15 sp6	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise module for containers 15 sp7	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp3-ltss	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp4-espos	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp4-ltss	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp5-espos	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise high performance computing 15 sp5-ltss	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise server 15 sp3-ltss	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise server 15 sp4-ltss	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise server 15 sp5-ltss	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp3	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp4	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise server for sap applications 15 sp5	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise micro 5.1	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux enterprise micro 5.2	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	enterprise storage 7.1	`28.3.3_ce-150000.230.1`	fixed
Opensuse	docker	leap 15.6	`28.3.3_ce-150000.230.1`	fixed
Suse	docker	linux micro 6.1	`28.4.0_ce-slfo.1.1_6.1`	fixed
Suse	docker	linux micro 6.2	`28.5.1_ce-160000.4.1`	fixed
Suse	docker	linux enterprise server 12 sp5-ltss	`28.3.3_ce-98.137.1`	fixed
Suse	docker	linux enterprise server ltss extended security 12 sp5	`28.3.3_ce-98.137.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	docker.io	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	docker.io	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	docker.io	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	docker.io	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Opensuse	docker	rpm	leap 16.0	`28.5.1_ce-160000.4.1`	Not reported	OPENSUSE-SU-2026:20057-1	Not reported
Opensuse	govulncheck-vulndb	rpm	tumbleweed	`0.0.20250811T192933-1.1`	Not reported	OPENSUSE-SU-2025:15434-1	Not reported
Opensuse	docker	rpm	tumbleweed	`28.3.3_ce-26.1`	Not reported	OPENSUSE-SU-2025:15395-1	Not reported
Suse	docker	rpm	linux enterprise server 16.0	`28.5.1_ce-160000.4.1`	Not reported	SUSE-SU-2026:20095-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 16.0	`28.5.1_ce-160000.4.1`	Not reported	SUSE-SU-2026:20095-1	Not reported
Suse	docker	rpm	linux micro 6.0	`28.3.3_ce-6.1`	Not reported	SUSE-SU-2025:20565-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.3	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.4	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.5	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise module for basesystem 15 sp7	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise module for containers 15 sp6	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise module for containers 15 sp7	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp3-ltss	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp4-espos	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp4-ltss	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp5-espos	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise high performance computing 15 sp5-ltss	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp3-ltss	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp4-ltss	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise server 15 sp5-ltss	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp3	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp4	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise server for sap applications 15 sp5	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.1	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux enterprise micro 5.2	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	enterprise storage 7.1	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Opensuse	docker	rpm	leap 15.6	`28.3.3_ce-150000.230.1`	Not reported	SUSE-SU-2025:02914-1	Not reported
Suse	docker	rpm	linux micro 6.1	`28.4.0_ce-slfo.1.1_6.1`	Not reported	SUSE-SU-2025:20743-1	Not reported
Suse	docker	rpm	linux micro 6.2	`28.5.1_ce-160000.4.1`	Not reported	SUSE-SU-2026:20112-1	Not reported
Suse	docker	rpm	linux enterprise server 12 sp5-ltss	`28.3.3_ce-98.137.1`	Not reported	SUSE-SU-2025:02913-1	Not reported
Suse	docker	rpm	linux enterprise server ltss extended security 12 sp5	`28.3.3_ce-98.137.1`	Not reported	SUSE-SU-2025:02913-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[docker-bash-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 28.3.3_ce-26.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-buildx]Unknown
Source package: [docker]
Details (1)
- 0.33.0-40.3 · x86_64 · tumbleweed
  Unknown · Fixed: 28.3.3_ce-26.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-fish-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 28.3.3_ce-26.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-rootless-extras]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 28.3.3_ce-26.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker-zsh-completion]Unknown
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · noarch · tumbleweed
  Unknown · Fixed: 28.3.3_ce-26.1
  Version impact unknown
  dsa · docker · opensuse · tumbleweed
[docker]Fixed
Source package: [docker]
Details (1)
- 29.4.0_ce-40.3 · x86_64 · tumbleweed
  Fixed · Fixed: 28.3.3_ce-26.1
  dsa · docker · opensuse · tumbleweed
[govulncheck-vulndb]Fixed
Source package: [govulncheck-vulndb]
Details (1)
- 0.0.20260828T144745-1.1 · noarch · tumbleweed
  Fixed · Fixed: 0.0.20250811T192933-1.1
  dsa · govulncheck-vulndb · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[docker-doc]Not affected
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Not affected
  dsa · docker.io · debian · bookworm
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Not affected
  dsa · docker.io · debian · bookworm
[docker.io]Not affected
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1+b6 · amd64 · bookworm
  Not affected
  dsa · docker.io · debian · bookworm
- 20.10.24+dfsg1-1+deb12u1+b6 · arm64 · bookworm
  Not affected
  dsa · docker.io · debian · bookworm
[golang-github-docker-docker-dev]Not affected
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Not affected
  dsa · docker.io · debian · bookworm
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Not affected
  dsa · docker.io · debian · bookworm

Observed: Oct 27, 2026, 12:31:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]