CVE catalog

CVE-2025-54410

docker.io: CVE-2025-54410

Severity: Low · CVSS 3.9CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Published: Jul 30, 2025, 1:24:50 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.17% · Oct 25, 2026

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected. Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	docker.io	sid	`28.5.2+dfsg4-5`	vulnerable
Debian	docker.io	forky	`28.5.2+dfsg4-5`	vulnerable
Debian	docker.io	trixie	`26.1.5+dfsg1-9+deb13u1`	vulnerable
Debian	docker.io	trixie-security	`26.1.5+dfsg1-9+deb13u1`	vulnerable
Debian	docker.io	bookworm	`20.10.24+dfsg1-1+deb12u1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	docker.io	source	sid	`(unfixed)`	not yet assigned	Not reported	[1110408]
Debian	docker.io	source	forky	`(unfixed)`	not yet assigned	Not reported	[1110408]
Debian	docker.io	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1110408]
Debian	docker.io	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1110408]

[Debian bug #1110408]

Notes

[trixie] docker.io: Minor issue, firewalld default backend is nftables and works fine [bookworm] docker.io: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[docker-doc]Affected
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Affected
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Affected
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
[docker.io]Affected
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1+b6 · amd64 · bookworm
  Affected
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
- 20.10.24+dfsg1-1+deb12u1+b6 · arm64 · bookworm
  Affected
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
[golang-github-docker-docker-dev]Affected
Source package: [docker.io]
Details (2)
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Affected
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12
- 20.10.24+dfsg1-1+deb12u1 · all · bookworm
  Affected
  dsa · docker.io · debian · bookworm; dsa · docker.io · debian · 12

[Debian 13 (Trixie)]

[docker-cli]Affected
Source package: [docker.io]
Details (4)
- 26.1.5+dfsg1-9+b13 · amd64 · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+b13 · arm64 · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security
  Affected
  dsa · docker.io · debian · 13
[docker-doc]Affected
Source package: [docker.io]
Details (4)
- 26.1.5+dfsg1-9 · all · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9 · all · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Affected
  dsa · docker.io · debian · 13
[docker.io]Affected
Details (4)
- 26.1.5+dfsg1-9+b13 · amd64 · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+b13 · arm64 · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · amd64 · trixie-security
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · arm64 · trixie-security
  Affected
  dsa · docker.io · debian · 13
[golang-github-docker-docker-dev]Affected
Source package: [docker.io]
Details (4)
- 26.1.5+dfsg1-9 · all · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9 · all · trixie
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Affected
  dsa · docker.io · debian · 13
- 26.1.5+dfsg1-9+deb13u1 · all · trixie-security
  Affected
  dsa · docker.io · debian · 13

Observed: Oct 27, 2026, 12:31:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]