critical CVSS 9.8

CVE-2025-34203·Docker vulnerability

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1002 and Application versions prior to 20.0.2614 (VA and SaaS deployments) contain multiple Docker containers that include outdated, end-of-life, unsupported, or otherwise vulnerable third-party components (examples: Nginx 1.17.x, OpenSSL 1.1.1d, various EOL Alpine/Debian/Ubuntu base images, and EOL Laravel/PHP libraries). These components are present across many container images and increase the product's attack surface, enabling exploitation chains when leveraged by an attacker. Multiple distinct EOL versions and unpatched libraries across containers; Nginx binaries date from 2019 in several images and Laravel versions observed include EOL releases (for example Laravel 5.5.x, 5.7.x, 5.8.x). This vulnerability has been identified by the vendor as: V-2024-014 — Outdated Dependencies.

Severity
critical
Software
Docker
Fixed in
22.0.1002
Published
2025-09-19

Affected versions

Until: 22.0.1002

Fixed in: 22.0.1002

How to fix this CVE

Upgrade Docker to version 22.0.1002 or later to eliminate the use of outdated and end-of-life third-party components embedded in container images. This critical update addresses the presence of vulnerable dependencies including legacy Nginx, OpenSSL, and obsolete base images that significantly expand the attack surface. Prioritize this upgrade immediately in your environment to prevent potential exploitation chains targeting these deprecated libraries.

sudo dnf upgrade docker-ce-22.0.1002 docker-ce-cli-22.0.1002 docker-buildx-plugin docker-compose-plugin

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'docker --version' to identify your current Docker version; vulnerable installations will report versions prior to 22.0.1002
  2. Execute 'docker image ls' and then 'docker inspect <image_id>' on running containers to list base image layers and check for EOL Alpine, Debian, or Ubuntu versions (e.g., Alpine < 3.15, Ubuntu < 20.04)
  3. Use 'docker exec <container_id> nginx -v' to verify Nginx version in running containers; versions prior to 1.20.x indicate vulnerable legacy binaries
  4. Verify the fix by running 'docker --version' after upgrade; confirm the version is 22.0.1002 or later, then rebuild and redeploy affected container images with updated base layers

FAQ

What is CVE-2025-34203?

CVE-2025-34203 is a critical vulnerability in Docker and Vasion Print Virtual Appliances caused by the bundling of obsolete, unsupported third-party components such as legacy Nginx binaries from 2019, end-of-life OpenSSL versions, and deprecated base images. This composition dramatically increases the attack surface and enables attackers to chain multiple exploits together.

Is CVE-2025-34203 being actively exploited?

No, CVE-2025-34203 is not currently listed on the CISA Known Exploited Vulnerabilities catalog, and no public exploits have been published. However, given its critical CVSS score of 9.8 and the ease with which legacy components can be targeted, immediate patching is strongly recommended.

What versions of Docker are affected by CVE-2025-34203?

All Docker versions prior to 22.0.1002 are affected. Additionally, Vasion Print Virtual Appliance versions before 22.0.1002 and Application versions before 20.0.2614 are vulnerable regardless of Docker version.

How do I check if my server is vulnerable to CVE-2025-34203?

Run 'docker --version' and compare the output to 22.0.1002; if your version is lower, you are vulnerable. For container-level assessment, execute 'docker inspect <container_id> | grep -i image' and inspect the base image tags for EOL markers.

Does Defensia detect CVE-2025-34203?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Docker is installed on a monitored server, CVE-2025-34203 will appear in your dashboard with remediation steps.

Related Docker CVEs

CVE-2026-57572CVSS 10Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's runtime user. The Docker API is unauthenticated by default, so a single request yields arbitrary command execution. This issue is fixed in version 0.9.0.
CVE-2026-26216CVSS 10Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec(). The __import__ builtin was included in the allowed builtins, allowing unauthenticated remote attackers to import arbitrary modules and execute system commands. Successful exploitation allows full server compromise, including arbitrary command execution, file read and write access, sensitive data exfiltration, and lateral movement within internal networks.
CVE-2026-44329CVSS 10free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.
CVE-2026-42298CVSS 10Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions). This can be achieved simply by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev. This issue has been patched via commit da44801.
CVE-2026-40281CVSS 10Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-34203. Free for 1 server.

Get started free