BuildKit has a possible runtime DoS via unbounded group parsing

낮음 2.3CVE-2026-61712 · GHSA-72x6-4j93-7w86 · GO-2026-6256 · Published 19/08/2026 · updated 09/09/2026

요약

CVE-2026-61712은(는) github.com/moby/buildkit에 영향을 주는 낮음 (CVSS 2.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.40%, 전체 취약점의 34.1%보다 높음.
조치: 0.31.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
github.com/moby/buildkit Go	`< 0.31.1`	`0.31.1`

Description

Impact

Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

Patches

Issue is fixed in BuildKit v0.31.1+

Workarounds

Use trusted build sources.

References

This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

NVD description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.