25.0.17

For a full list of pull requests and changes in this release, refer to the relevant GitHub milestone:

• moby/moby, 25.0.17 milestone
• Changes to the Engine API, see API version history.

Bug fixes and enhancements

• Fix CVE-2026-41568: symlink escape in mount destination creation. https://github.com/moby/moby/pull/52648
• Decompress archives before entering container filesystem, fixing CVE-2026-41567. https://github.com/moby/moby/pull/52647
• Fix CVE-2026-42306: bind mount target redirection via symlink swap during docker cp. https://github.com/moby/moby/pull/52657
• Vendor github.com/containerd/containerd v1.7.33 to mitigate CVE-2024-40635. https://github.com/moby/moby/pull/49909