Executive brief
BuildKit is a toolkit for building container images. A maliciously crafted container base image can trigger unbounded parsing of group configuration files, causing memory exhaustion and crashing the BuildKit daemon (buildkitd). This affects build operations and can disrupt container image creation pipelines.
Technical details
This vulnerability is a resource exhaustion flaw (CWE-770) in BuildKit's parsing of passwd and group files within container images. When processing a maliciously crafted base image, the parser does not impose limits on the size of group entries, allowing an attacker to craft an image with excessively large group file entries. This leads to unbounded memory allocation during parsing, causing an Out-of-Memory (OOM) condition that terminates the buildkitd process. The attack vector is network-based via a malicious image supplied as a build source; no authentication or elevated privileges are required. The patch (v0.31.1+) adds size limits to parsed passwd and group files. Mitigation until patching is to use only trusted build sources.
Affected products
- Moby BuildKit <= 0.31.0
Timeline
- 2026-06-24: disclosed: Advisory published
- 2026-06-24: patched: Fixed in BuildKit v0.31.1
References
- https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86
- https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1
- https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255
- https://github.com/moby/buildkit/releases/tag/v0.31.1
- https://api.github.com/repos/moby/buildkit/security-advisories/GHSA-72x6-4j93-7w86