On October 8, 2026, Docker Engine 29.9.0 updated its Go runtime and closed five CVEs that let an HTTP/2 client crash the daemon or exhaust its memory, while enabling lazy-pull for remote snapshotters. If your Docker API is reachable from the network, schedule the upgrade; otherwise, use the moment to check your exposure.

Docker Engine 29.8.0, released September 3, 2026, introduces a --umask flag to set a container’s file-creation mask and adds AppArmor/SELinux rules that block the 32-bit socketcall(2) path to AF_VSOCK. Upgrade if you share volumes between host and containers or harden your containers.