CVE-2026-61712: Denial of Service via Unbounded Resource Allocation in moby/buildkit
Vulnerability ID: CVE-2026-61712
CVSS Score: 2.3
Published: 2026-08-19
moby/buildkit is susceptible to a denial-of-service vulnerability prior to version 0.31.1. When BuildKit processes user or group directives from untrusted build contexts or base images, it reads configuration databases such as /etc/passwd and /etc/group directly into memory without enforcing boundaries. An attacker can exploit this behavior by engineering malicious files that trigger host memory exhaustion or block daemon threads indefinitely.
TL;DR
moby/buildkit prior to version 0.31.1 does not enforce size limits or validate file types when reading user and group databases inside build contexts, enabling attackers to crash the buildkitd daemon via memory exhaustion (OOM) or hang execution threads.
Technical Details
- CWE ID: CWE-770
- Attack Vector: Network
- CVSS v4.0: 2.3 (Low)
- Impact: Denial of Service (DoS)
- Exploit Status: none
- CISA KEV Status: No
Affected Systems
- moby/buildkit
-
buildkit: < 0.31.1 (Fixed in:
0.31.1)
Code Analysis
Commit: 408266e
Fix unbounded reading of user files in OCI executor
--- a/executor/oci/user.go\n+++ b/executor/oci/user.go\n@@ -11,4 +11,27 @@\n+const maxUserFileBytes = 10 << 20\n+func openUserFile(root, p string) (io.ReadCloser, error) {\n+...\n+info, err := f.Stat()\n+...\n+if !info.Mode().IsRegular() {\n+...\n+return &limitedReadCloser{ReadCloser: f, r: &io.LimitedReader{R: f, N: maxUserFileBytes + 1}, name: p}, nil
Commit: 69a3924
Limit size of user and group files in LLB solver ops
--- a/solver/llbsolver/ops/user_linux.go\n+++ b/solver/llbsolver/ops/user_linux.go\n@@ -21,1 +21,1 @@\n-ufile, err := os.Open(passwdPath)\n+ufile, err := openUserFile(dir, passwdPath)
Mitigation Strategies
- Upgrade moby/buildkit to version 0.31.1 or higher.
- Configure cgroup-level memory limits on build nodes to prevent host system crashes.
- Run the buildkitd daemon in rootless mode to restrict container escape vectors.
Remediation Steps:
- Identify the current BuildKit version using the command 'buildkitd --version'.
- If the version is less than 0.31.1, download the updated binary package from the official repository.
- Update systemd services or Kubernetes runner definitions to deploy BuildKit 0.31.1.
- Restart the buildkitd daemon using 'systemctl restart buildkit'.
References
Read the full report for CVE-2026-61712 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)