# Moby (Docker daemon) — CWE-407 Disclosure Brief
**2026-03-27 · Patch available — awaiting upstream merge**

## Finding

One O(n²) defect in the Moby Docker daemon's capability management. `TweakCapabilities()` uses `slices.Contains(capDrop)` in a loop over all capabilities, causing O(n²) processing per container start. Patch ready for upstream review.

## The Defects

**moby-0001 (PATCHED — HIGH):** `daemon/pkg/oci/caps/utils.go`

```go
// TweakCapabilities() — per container start:
for _, cap := range allCaps {
    if slices.Contains(capDrop, cap) {  // O(n) per cap per container start
        continue
    }
    ...
}
```

`slices.Contains(capDrop)` performs O(n) scan over `capDrop` for every capability in `allCaps`. For N capabilities and D dropped caps: **O(N × D) per container start**. **Measured ratio: 38×.**

## Complexity Proof

For N=40 capabilities, D=38 dropped caps:
- O(N×D) = 1,520 comparisons per container start
- Fixed: `map[string]bool` cap-drop set → O(N + D)
- **38× measured ratio.**

## Impact

All Docker Engine / Moby deployments launching containers with capability modification — essentially all production Docker and Kubernetes deployments using default security profiles. `TweakCapabilities()` runs on every `docker run` and every container start. CI/CD systems, container platforms, and Kubernetes nodes with high container launch rates are most affected. Moby is the upstream project for Docker Engine.

## The Fix

Pre-build a `map[string]bool` from `capDrop` before the loop:

```go
// Before
for _, cap := range allCaps {
    if slices.Contains(capDrop, cap) { continue }  // O(D) per cap
}

// After
// CWE-407 fix: map[string]bool for O(1) drop-check instead of O(D) slices.Contains.
dropSet := make(map[string]bool, len(capDrop))
for _, c := range capDrop { dropSet[c] = true }
for _, cap := range allCaps {
    if dropSet[cap] { continue }
}
```

## Patch

`defects/moby/patch/moby-0001-caps-utils-map.patch`

## What We Ask

1. Confirm receipt and assign a GitHub Security Advisory or issue reference.
2. Validate the patch against your capability management test suite.
3. Assess CVE eligibility — fires on every container start with capability modification.
4. Coordinate a disclosure date — we are targeting 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.
