The non-quiet copy paths printed the "Successfully copied ..." summary
unconditionally, even when the copy failed. Copying a directory onto an
existing regular file therefore printed "Successfully copied 0B" before
reporting "cannot copy directory". Only print the summary when the copy
succeeded, in both the from-container and to-container directions.
Also rename the res variable in copyFromContainer to err: it only holds
the error returned by archive.CopyTo, so name it err to make that clear
instead of suggesting some other "result" return type.
Signed-off-by: Xiong Han <3324733895@qq.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The daemon / dockerd reference, docker engine plugin documentation,
and the Docker Engine feature deprecation documentation was imported
into the Moby repository in [moby@b9ce036].
Remove the files from this repository, and replace them with (temporary)
stubs pointing to their new location.
[moby@b9ce036]: https://github.com/moby/moby/commit/b9ce036ac8bfd28855d8aabc53fa451ce2339e1b
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This release includes 12 security fixes following the security policy:
- net/http: HTTP/1 server crash due to MaxBytesReader header race
For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
"Connection: close" header is automatically set without synchronization,
which might race with another header being set explicitly in the server
handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
MaxBytesHandler can crash due to runtime panic if its handler reads the
request body concurrently with writing the response header.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.
- cmd/go: unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags
Building a malicious package that uses cgo could cause arbitrary code execution
at build time through several compiler and linker flags permitted in "#cgo"
directives.
Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec
files, and CRT startup objects to an attacker-controlled directory; "-target" in
Clang falls back to executing target helper tools from the current working
directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a
regular file on disk to GNU ld.bfd, which interprets it as a positional linker
script; and "-x" permitted specifying arbitrary compiler input languages beyond
those supported by cgo.
"--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and
"-Wl,-syslibroot" are verified not to point to regular files, and "-x" is
restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97033 and Go issue https://go.dev/issue/82577.
- cmd/go: arbitrary command execution via GCC spec files in cgo linker search directories
When using GCC, building a malicious package that uses cgo could cause arbitrary
command execution at link time via untrusted GCC spec files ("specs" or
"*.spec").
When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS",
GCC's built-in link spec evaluates "%:include(libgomp.spec)" or
"%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot
directories (including subdirectories and multilib sibling directories such as
"../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is
used or when "-fsanitize=" is combined with "-static" or "-static-lib*".
The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories
(and the working and package directories when applicable) that contain GCC spec
files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97034 and Go issue https://go.dev/issue/82576.
- cmd/go: unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo
When using Clang or GCC, building a malicious package that uses cgo could cause
unexpected code execution at build time or write files to arbitrary
directories via "-gen-" or "-gnat" flags in "#cgo" directives.
The "-g*" wildcard in the compiler and linker flag allowlists previously
matched Clang's two-argument "-gen-cdb-fragment-path " flag and GCC's
two-argument "-gnatO " flag, permitting compilation database fragments
and sidecar output files to be written to arbitrary directories and
desynchronizing flag argument parsing between the go command and the compiler
driver so that subsequent arguments could be passed as unvalidated positional
inputs to the linker.
"-gen-" and "-gnat" flags are now disallowed in "#cgo" compiler and linker
flags.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97035 and Go issue https://go.dev/issue/82575.
- cmd/go: arbitrary code execution during build on darwin via "-l to_library" in cgo
On Darwin, building a malicious package that uses cgo could cause arbitrary code
execution when using the Apple linker due to passing "-l to_library " in a
"#cgo LDFLAGS" directive.
The Apple linker recombines the separated arguments "-l" and "to_library" into
"-lto_library", which loads an arbitrary LTO plugin dynamic library at link
time.
The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS",
rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and
"-library-path", and checks recombined "-l" arguments against disallowed linker
flags and patterns.
Thanks to Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/) for reporting this issue.
This is CVE-2026-97036 and Go issue https://go.dev/issue/82574.
- cmd/go: linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo
Building a malicious package that uses cgo could cause arbitrary code execution
at link time by passing linker script files to the host linker via "#cgo LDFLAGS".
Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath",
"-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second
argument without a "-Wl," prefix, which the compiler driver passes directly to
the linker as a positional input file. Additionally, when using GNU ld.bfd,
flags such as "-framework", "-Wl,-framework", "-Wl,-undefined",
"-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms)
"-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker
scripts if they named a regular file on disk.
The go command now requires a "-Wl," prefix on the second token of split "-Wl,"
flags (except "-Wl,-R"), verifies that these flags do not reference linker
script files, and disallows bare "-Wl,--warn-backrefs-exclude".
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97037 and Go issue https://go.dev/issue/82573.
- cmd/go: arbitrary code execution via crafted .syso files and cgo linker input files
Building a malicious package containing ".syso" files or cgo linker inputs could
inject arbitrary linker flags or execute arbitrary code at link time.
Linker input files—including ".syso" files, direct object or library inputs in
"#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external
linker without validating their format or checking for embedded linker options.
Across platforms, this allowed executing GNU ld implicit linker scripts
disguised as libraries or ".syso" files (or loaded via "-l:" or "-l"
containing path separators), injecting unallowlisted linker flags via PE/COFF
".drectve" sections on Windows or Mach-O "LC_LINKER_OPTION" load commands on
Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation
sections in ELF, PE/COFF, or Mach-O objects.
The go command now verifies that ".syso" files, direct linker inputs, and
libraries in "-L" directories are valid binary objects or archives that do not
contain unallowlisted ".drectve" directives, "LC_LINKER_OPTION" load commands,
or LTO IR sections, and disallows "-l:" and ":", "=", or path
separators in "-l" flags.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97038 and Go issue https://go.dev/issue/82572.
- cmd/go: flag sanitization bypass via "#cgo pkg-config:" directives
Building a malicious package that uses "#cgo pkg-config:" directives could
load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker
flags.
The pkg-config flag allowlist previously permitted "--with-path=" and
"--personality=", allowed "--define-variable=" values beginning with "=" or "$"
(which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or
"-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc"
or containing path separators or "..", which caused pkg-config to load local
".pc" files directly from the package directory. In addition, flags returned by
"pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether
internal linking is safe.
The go command now disallows "--with-path=", "--personality=", leading "=" or
"$" characters in "--define-variable=" values, and local ".pc" paths in
"#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal
linking compatibility.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97039 and Go issue https://go.dev/issue/82571.
- cmd/go, cmd/link: cgo directive injection via .syso files disguised as Go object files
Building a package containing a crafted ".syso" file could bypass cgo flag
validation and inject arbitrary linker flags when linking.
When loading ".syso" entries from a package archive, the linker only checked for
recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling
through to Go object parsing. A ".syso" file beginning with a "go object" header
was parsed as a Go compiler object, allowing untrusted cgo metadata directives
(such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to
be passed to the external linker without validation. Additionally, ".syso"
filenames longer than 16 bytes lost their ".syso" extension when truncated in
archive headers, and unrecognized ".syso" formats forced external linking in
pure-Go builds.
The linker now rejects ".syso" files that are not recognized host object
formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating
long archive member names.
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97040 and Go issue https://go.dev/issue/82570.
- cmd/compile, cmd/link: host linker flag injection via //go:cgo_* directives
Building a malicious package containing "//go:cgo_*" compiler directives could
inject arbitrary flags into the external linker invocation on ELF platforms.
The compiler and linker did not reject commas in "//go:cgo_import_dynamic",
"//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static",
and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic
linker path using "-Wl,--dynamic-linker,". Furthermore, the two-argument
form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source
files) could overwrite the external symbol name of a symbol already marked for
cgo export. A symbol name or dynamic linker path containing a comma or leading
"@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into
arbitrary host linker flags or response file arguments.
The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic
linker directives, the linker passes "-Wl,--dynamic-linker=", and
"cgo_import_dynamic" no longer overwrites symbols exported via
"cgo_export_dynamic" or "cgo_export_static".
Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
This is CVE-2026-97041 and Go issue https://go.dev/issue/82569.
- cmd/cgo, cmd/compile, cmd/link: linker flag injection via cgo_import_dynamic and PE DLL names
Building a malicious package that uses "//go:cgo_import_dynamic" or links
against a crafted PE object on Windows could pass unsafe library arguments to
the external linker.
The compiler only checked the first character of the library name in
"//go:cgo_import_dynamic" directives and skipped validation in cgo-generated
files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate
imported DLL names extracted from PE object files before emitting "-l"
flags for the external linker, allowing a crafted DLL name containing ".." path
traversal or special characters to reference arbitrary files on disk.
The compiler now validates every character of the library name in
"//go:cgo_import_dynamic" directives (including in cgo-generated files on
Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject
PE imported DLL names containing path separators, "..", ":", or leading "-" or
"@".
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97042 and Go issue https://go.dev/issue/82568.
- cmd/go, cmd/compile: unexpected code execution via escaped quotes in //go:cgo_ldflag
Building a malicious package that uses cgo could bypass "#cgo LDFLAGS"
validation and cause unexpected code execution at build time, or cause the go
command to panic, via crafted quoting in "//go:cgo_ldflag" directives.
When "cmd/cgo" generates "_cgo_gotypes.go", it quotes each "#cgo LDFLAGS"
argument with strconv.Quote in a "//go:cgo_ldflag" directive, but "cmd/compile"
and "cmd/go" parsed those directives by splitting on raw quote characters
without handling backslash escapes or unquoting the string. This mismatch
allowed disallowed linker flags or unvalidated linker search paths to be
smuggled past the go command's flag checks and passed to the external linker.
In addition, deduplicating LDFLAGS in the go command could panic with an
out-of-bounds slice index when a prefix of the flag list matched near the end
of the slice.
"cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and
unquote "//go:cgo_*" pragma strings with strconv.Unquote, and the slice bounds
check in processCgoOutputs has been fixed.
This issue was found by the Go Security Team during an internal audit.
This is CVE-2026-97043 and Go issue https://go.dev/issue/82567.
release notes: https://go.dev/doc/devel/release#go1.27.4
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
The CLI flushes traces and metrics at exit with a 50ms timeout
(ExportTimeout). The OTLP gRPC exporters were created with the default
retry policy, so when the endpoint refuses the connection the export
keeps backing off until the timeout expires instead of returning.
This happens on every command when the current context points at a
unix socket that has no listener, for example Docker Desktop's context
while Desktop is not running, which leaves its analytics socket file
behind. A retry cannot complete within 50ms anyway, so turn retries off.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Alexandre Zollinger Chohfi <alzollin@microsoft.com>
GitHub Actions retired macOS 14 runners on November 2, 2026.
Replace macos-14 with macos-26 to continue testing on supported
macOS versions.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Paweł Gronowski
Xiong Han
Sebastiaan van Stijn
Sebastiaan van Stijn
dependabot[bot]
Mend Renovate
Alexandre Zollinger ChohfiandCopilot App