Executive brief
BuildKit is a toolkit used to convert source code into build artifacts like Docker images. A vulnerability has been identified where a malicious client or a compromised build frontend can send a specially crafted request that causes the BuildKit service to crash. This results in a denial-of-service, preventing teams from building new container images until the service is restarted.
Technical details
A denial-of-service vulnerability exists in Moby BuildKit due to improper input validation (CWE-20) when processing parameters from a frontend. An attacker with the ability to provide a malicious frontend (e.g., via the #syntax directive in a Dockerfile) or a crafted client request can trigger a Go panic in the BuildKit daemon. This crash terminates the process and disrupts all active build operations. The issue is fixed in BuildKit version 0.31.2. Users are advised to upgrade or avoid using untrusted frontends.
Affected products
- Moby BuildKit <= v0.31.1
Timeline
- 2026-07-16: advisory: GitHub Security Advisory published by maintainers
- 2026-07-21: disclosed: CVE published to NVD
- 2026-07-21: patched: Fix released in version 0.31.2