BuildKit has a possible runtime DoS via unbounded group parsing

THẤP 2.3CVE-2026-61712 · GHSA-72x6-4j93-7w86 · GO-2026-6256 · Công bố 19/08/2026 · cập nhật 09/09/2026

Tóm tắt nhanh

CVE-2026-61712 là lỗ hổng mức THẤP (CVSS 2.3) ảnh hưởng github.com/moby/buildkit.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.40%, cao hơn 34.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.31.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
github.com/moby/buildkit Go	`< 0.31.1`	`0.31.1`

Mô tả

Impact

Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

Patches

Issue is fixed in BuildKit v0.31.1+

Workarounds

Use trusted build sources.

References

This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

Mô tả của NVD

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.