Missing initialization of resource in moby - CVE-2025-54410

Detailed vulnerability description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to Docker fails to re-create iptables rules that isolate bridge networks when firewalld reloads, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. A local user can gain unauthorized access to sensitive information on the system.

How to mitigate CVE-2025-54410

Sources

• https://firewalld.org/documentation/howto/reload-firewalld.html
• https://github.com/moby/moby/security/advisories/GHSA-4vq8-7jfc-9cvp