CVE-2026-61712

Received Received - Intake

Memory Exhaustion in BuildKit User Resolution

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-61712

EUVD

EUVD-2026-62837

Affected Vendors & Products

Vendor	Product	Version / Range
buildkit	buildkit	to 0.31.1 (exc)
moby	buildkit	to 0.31.1 (exc)
moby	buildkit	0.31.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in BuildKit (CVE-2026-61712) involves unbounded memory consumption when parsing /etc/passwd and /etc/group files during user resolution. A malicious base image or build could provide oversized files that cause memory exhaustion, leading to an out-of-memory termination of the buildkitd process.

Detection Guidance

Check BuildKit version with docker buildx version or buildctl --version. If version is below 0.31.1, the system is vulnerable. Monitor buildkitd process memory usage for unexpected spikes during builds.

Impact Analysis

The vulnerability can cause denial-of-service by crashing the buildkitd process due to memory exhaustion. This disrupts build operations and may lead to failed builds or system instability if exploited by a malicious container image.

Mitigation Strategies

Upgrade BuildKit to version 0.31.1 or later. Avoid using untrusted base images in builds. Restart buildkitd after upgrade to apply fixes.

Hi! I’m here to help you understand CVE-2026-61712. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70