CVE-2026-61712

Summary

BuildKit has a possible runtime DoS via unbounded group parsing

Severity

low

EPSS

0.4% (p34)

CWE

CWE-770

Also known as

GHSA-72x6-4j93-7w86

Published

2026-08-19

Updated

2026-08-19

Advisory details

Impact

Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

Patches

Issue is fixed in BuildKit v0.31.1+

Workarounds

Use trusted build sources.

References

This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

References

• https://github.com/advisories/GHSA-72x6-4j93-7w86
• https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86
• https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1
• https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255
• https://github.com/moby/buildkit/releases/tag/v0.31.1

Related advisories

• CVE-2026-61711 — medium · Go/github.com/moby/buildkit
• CVE-2026-33748 — medium · Go/github.com/moby/buildkit
• CVE-2026-33747 — medium · Go/github.com/moby/buildkit
• CVE-2026-59873 — critical · npm/tar
• CVE-2026-87011 — high · PyPI/open-webui
• CVE-2026-86075 — high · npm/n8n
• CVE-2026-59161 — high · Go/github.com/xuri/excelize/v2
• CVE-2026-83615 — high · npm/@xmldom/xmldom

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity