{"schema_version":"1.9.0","id":"CVE-2017-14992","published":"2017-11-01T17:29:00.277Z","modified":"2026-08-27T03:47:26.280887721Z","aliases":["GHSA-hqwh-8xv9-42hw","GO-2025-3640"],"related":["SUSE-SU-2018:0386-1","SUSE-SU-2025:03540-1","SUSE-SU-2025:03545-1","openSUSE-SU-2024:10722-1","openSUSE-SU-2024:11385-1","openSUSE-SU-2025:15033-1","openSUSE-SU-2025:15589-1"],"details":"Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/docker-archive/docker-ce","events":[{"introduced":"02c1d876176546b5f069dae758d6a7d2ead6bd48"},{"last_affected":"afdb6d44a80f777069885a9ee0e0f86cf841b1bb"}],"database_specific":{"cpe":["cpe:2.3:a:docker:docker:17.06.0:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.1:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.2:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.09.0:*:*:*:community:*:*:*"],"extracted_events":[{"introduced":"17.06.0"},{"last_affected":"17.06.0"},{"introduced":"17.06.1"},{"last_affected":"17.06.1"},{"introduced":"17.06.2"},{"last_affected":"17.06.2"},{"introduced":"17.09.0"},{"last_affected":"17.09.0"}],"source":"CPE_STRING"}}],"versions":["17.06.0","17.06.1","17.06.2","17.09.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14992.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/docker-archive/engine","events":[{"introduced":"0"},{"last_affected":"20f81dde9bd97c86b2d0e33bbbf1388018611929"},{"introduced":"60ccb2265b0574d6c1c1090876a1d1ab32bed60e"},{"last_affected":"91437e70a02d6292a9e706378df34a67d5f7371e"}],"database_specific":{"cpe":["cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.03.0:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.03.1:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.03.2:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.0:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.1:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.2:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.09.0:*:*:*:community:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.10.3"},{"introduced":"17.03.0"},{"last_affected":"17.03.0"},{"introduced":"17.03.1"},{"last_affected":"17.03.1"},{"introduced":"17.03.2"},{"last_affected":"17.03.2"},{"introduced":"17.06.0"},{"last_affected":"17.06.0"},{"introduced":"17.06.1"},{"last_affected":"17.06.1"},{"introduced":"17.06.2"},{"last_affected":"17.06.2"},{"introduced":"17.09.0"},{"last_affected":"17.09.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["17.03.0","17.03.1","17.03.2","17.06.0","17.06.1","17.06.2","17.09.0","v17.09.0-ce","v17.09.0-ce-rc3","v17.09.0-ce-rc2","v17.09.0-ce-rc1","docs-v1.12.0-rc4-2016-07-15","v1.10.3","v1.10.2","v1.10.1","v0.7.2","v0.7.1","v0.7.0","v0.6.5","v0.5.0","v0.4.7","v0.4.5","v0.4.4","v0.4.2","v0.4.1","v0.3.2","v0.3.1","v0.3.0","v0.2.2","v0.2.1","v0.2.0","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0","upstream/0.1.3","0.0.3","upstream/0.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14992.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/moby/moby","events":[{"introduced":"0"},{"last_affected":"20f81dde9bd97c86b2d0e33bbbf1388018611929"},{"introduced":"60ccb2265b0574d6c1c1090876a1d1ab32bed60e"},{"last_affected":"91437e70a02d6292a9e706378df34a67d5f7371e"}],"database_specific":{"cpe":["cpe:2.3:a:docker:docker:*:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.03.0:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.03.1:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.03.2:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.0:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.1:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.06.2:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.09.0:*:*:*:community:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.10.3"},{"introduced":"17.03.0"},{"last_affected":"17.03.0"},{"introduced":"17.03.1"},{"last_affected":"17.03.1"},{"introduced":"17.03.2"},{"last_affected":"17.03.2"},{"introduced":"17.06.0"},{"last_affected":"17.06.0"},{"introduced":"17.06.1"},{"last_affected":"17.06.1"},{"introduced":"17.06.2"},{"last_affected":"17.06.2"},{"introduced":"17.09.0"},{"last_affected":"17.09.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["17.03.0","17.03.1","17.03.2","17.06.0","17.06.1","17.06.2","17.09.0","v17.09.0-ce","v17.09.0-ce-rc3","v17.09.0-ce-rc2","v17.09.0-ce-rc1","docs-v1.12.0-rc4-2016-07-15","v1.10.3","v1.10.2","v1.10.1","v0.7.2","v0.7.1","v0.7.0","v0.6.5","v0.5.0","v0.4.7","v0.4.5","v0.4.4","v0.4.2","v0.4.1","v0.3.2","v0.3.1","v0.3.0","v0.2.2","v0.2.1","v0.2.0","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0","upstream/0.1.3","0.0.3","upstream/0.1.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14992.json"}}],"references":[{"type":"ADVISORY","url":"https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/"},{"type":"REPORT","url":"https://github.com/moby/moby/issues/35075"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:docker:docker:1.12.6-0:*:*:*:community:*:*:*","cpe:2.3:a:docker:docker:17.03.0:*:*:*:community:*:*:*"],"extracted_events":[{"introduced":"1.12.6-0"},{"last_affected":"1.12.6-0"},{"introduced":"1.12.6-0"},{"last_affected":"1.12.6-0"},{"introduced":"1.12.6-0"},{"last_affected":"1.12.6-0"},{"introduced":"17.03.0"},{"last_affected":"17.03.0"}],"source":"CPE_STRING","vendor_product":"docker:docker"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}