# CVE-2026-61712: Moby BuildKit denial of service via unbounded group parsing

Source: https://junglewise.ai/threats/cve-2026-61712-moby-buildkit-denial-of-service-via-unbounded-group-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61712 · Severity: medium · CVSS 4 · Published 2026-08-19

BuildKit is a toolkit for building container images. A maliciously crafted container base image can trigger unbounded parsing of group configuration files, causing memory exhaustion and crashing the BuildKit daemon (buildkitd). This affects build operations and can disrupt container image creation pipelines.

Technologies: [github.com/moby/buildkit (Go)](https://junglewise.ai/threats/technologies/github-com-moby-buildkit). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-61712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61712 being exploited in the wild.

**How severe is CVE-2026-61712?** Medium severity, with a CVSS score of 4, published 19 August 2026.

**Which products and versions are affected?** github.com/moby/buildkit (Go) <= 0.31.0, SEMVER:introduced=0,fixed=0.31.1.

**Is there a fix for CVE-2026-61712?** Yes. github.com/moby/buildkit (Go): upgrade to 0.31.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61712 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61712?** Check whether you run github.com/moby/buildkit (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/moby/buildkit (Go): upgrade to 0.31.1 or later

  ```sh
  go get github.com/moby/buildkit@v0.31.1
  ```


## Technical details

This vulnerability is a resource exhaustion flaw (CWE-770) in BuildKit's parsing of passwd and group files within container images. When processing a maliciously crafted base image, the parser does not impose limits on the size of group entries, allowing an attacker to craft an image with excessively large group file entries. This leads to unbounded memory allocation during parsing, causing an Out-of-Memory (OOM) condition that terminates the buildkitd process. The attack vector is network-based via a malicious image supplied as a build source; no authentication or elevated privileges are required. The patch (v0.31.1+) adds size limits to parsed passwd and group files. Mitigation until patching is to use only trusted build sources.

## Affected products

- Moby BuildKit <= 0.31.0

## Identifiers

- CVE-2026-61712
- GHSA-72x6-4j93-7w86
- GO-2026-6256

## Timeline

- 2026-06-24: disclosed: Advisory published
- 2026-06-24: patched: Fixed in BuildKit v0.31.1

## References

- [https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86](https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86)
- [https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1](https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1)
- [https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255](https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255)
- [https://github.com/moby/buildkit/releases/tag/v0.31.1](https://github.com/moby/buildkit/releases/tag/v0.31.1)
- [https://api.github.com/repos/moby/buildkit/security-advisories/GHSA-72x6-4j93-7w86](https://api.github.com/repos/moby/buildkit/security-advisories/GHSA-72x6-4j93-7w86)

## Related threats

- [Moby BuildKit custom frontend security bypass](https://junglewise.ai/threats/cve-2026-61711-moby-buildkit-custom-frontend-security-bypass)
- [GO-2026-4858 - BuildKit's Malicious frontend can cause file escape outside of storage root in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2026-33747-buildkit-s-malicious-frontend-can-cause-file-escape-outside-of)
- [BuildKit Git URL subdir component can cause access to restricted files](https://junglewise.ai/threats/cve-2026-33748-buildkit-git-url-subdir-component-can-cause-access-to-restricted)
- [GO-2024-2493 - Host system file access in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2024-23651-buildkit-vulnerable-to-possible-race-condition-with-accessing)
- [GO-2024-2492 - Panic in github.com/moby/buildkit](https://junglewise.ai/threats/cve-2024-23650-buildkit-vulnerable-to-possible-panic-when-incorrect-parameters)