CVE-2016-3697: Docker

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

Affected products

• Docker Docker: up to and including 1.11.1
• Linuxfoundation Runc: up to and including 0.0.9
• Opensuse Opensuse: version 13.2 only

Published 2016-06-01. Last modified 2026-06-17.