# CVE-2026-93323: Moby buildkit Dockerfile memory exhaustion via oversized files

Source: https://junglewise.ai/threats/cve-2026-93323-the-dockerfile-frontend-loaded-the-dockerfile-and-dockerignore  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-93323 · Severity: info · Published 2026-10-05

Moby buildkit is a container image build engine used to construct Docker images. An attacker with the ability to submit build contexts containing extremely large Dockerfile or .dockerignore files can cause the buildkitd daemon to consume excessive memory and crash, disrupting all builds running on the same instance. This denial-of-service attack requires local or close network access to the build daemon.

Technologies: [Moby BuildKit](https://junglewise.ai/threats/technologies/moby-buildkit). Vendors: [Moby](https://junglewise.ai/threats/vendors/moby).

## Quick answers

**Is CVE-2026-93323 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93323 being exploited in the wild.

**How severe is CVE-2026-93323?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Moby BuildKit before 0.33.1.

**Is there a fix for CVE-2026-93323?** Yes: fixed in v0.33.1. Until then: Only build from trusted build contexts. Run buildkitd under a memory limit (cgroup or container limit) so that memory exhaustion is contained to the daemon rather than affecting the host system.</anigation>
<parameter name="confidence">0.95 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93323 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-93323?** Check whether you run Moby BuildKit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in v0.33.1

Only build from trusted build contexts. Run buildkitd under a memory limit (cgroup or container limit) so that memory exhaustion is contained to the daemon rather than affecting the host system.</anigation>
<parameter name="confidence">0.95

## Technical details

The Dockerfile frontend in buildkit loads Dockerfile and .dockerignore files from a build context into memory without enforcing a maximum size limit. An oversized file (>16 MiB) triggers unbounded memory allocation proportional to file size, potentially exhausting available memory and terminating the daemon. Exploitation requires local or adjacent network access with low privilege and no authentication to submit a malicious build context. A fix enforces a 16 MiB size limit on these files.

## Affected products

- Moby buildkit before 0.33.1

## Timeline

- 2026-09-30: disclosed
- 2026-09-30: patched: v0.33.1 released

## References

- [https://github.com/moby/buildkit/releases/tag/v0.33.1](https://github.com/moby/buildkit/releases/tag/v0.33.1)
- [https://github.com/moby/buildkit/security/advisories/GHSA-mgqf-486f-49vp](https://github.com/moby/buildkit/security/advisories/GHSA-mgqf-486f-49vp)

## Related threats

- [Moby BuildKit arbitrary extended attribute setting](https://junglewise.ai/threats/cve-2026-121520-in-buildkit-versions-prior-to-v0-34-1-a-malicious-client-with)
- [Moby BuildKit Git source resolver panic](https://junglewise.ai/threats/cve-2026-121522-in-buildkit-versions-v0-26-0-through-v0-34-1-a-specific-build)
- [Moby BuildKit malformed LLB merge operation denial of service](https://junglewise.ai/threats/cve-2026-93321-a-malicious-frontend-can-submit-an-llb-definition-that-causes)
- [Moby BuildKit proxy CA cleanup disruption](https://junglewise.ai/threats/cve-2026-93315-when-proxy-networking-with-ca-injection-is-enabled-a-build-can)
- [Moby BuildKit Git source policy validation bypass](https://junglewise.ai/threats/cve-2026-93326-a-build-step-for-a-git-source-crafted-in-a-specific-way-can)