GitHub Advisoryadvisory · Go

GHSA-72x6-4j93-7w86 BuildKit has a possible runtime DoS via unbounded group parsing

LOW Published 2026-08-19 Modified 2026-08-19 Official page ↗
Aliases
CVE-2026-61712
Ecosystem
Go
Packages
github.com/moby/buildkit
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2026-08-19

Affected packages

• Go github.com/moby/buildkit: < 0.31.1 → fixed in 0.31.1

Description

Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build sources. References This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

Related

Alias · CVE (1)

  • CVE-2026-61712 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References