BuildKit Daemon Crash Due to Metadata Resolution Flaw
CVE-2026-121522

6.7MEDIUM

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121522?

In specific versions of BuildKit, a flaw exists where a build definition that resolves metadata for the same Git source reference twice can result in the BuildKit daemon crashing. This interruption in the build process can affect ongoing tasks and workflow efficiency. The issue has been addressed in version 0.34.2, making it essential for users of affected versions to upgrade promptly to mitigate potential disruptions.

Affected Version(s)

BuildKit 0.26.0 < 0.34.2

References

https://github.com/moby/buildkit/security/advisories/GHSA...
vendor-advisory

CVSS V4

Score:
6.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.