BuildKit has a possible runtime DoS via unbounded group parsing

FAIBLE 2.3CVE-2026-61712 · GHSA-72x6-4j93-7w86 · GO-2026-6256 · Published 19/08/2026 · updated 09/09/2026

En bref

CVE-2026-61712 est une vulnérabilité FAIBLE (CVSS 2.3) touchant github.com/moby/buildkit.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.40%, plus élevée que 34.1% des vulnérabilités.
Correctif : mettre à jour vers 0.31.1 ou plus récent.

Package	Affected versions	Patched versions
github.com/moby/buildkit Go	`< 0.31.1`	`0.31.1`

Description

Impact

Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

Patches

Issue is fixed in BuildKit v0.31.1+

Workarounds

Use trusted build sources.

References

This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

NVD description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.