BuildKit User ID Resolution Vulnerability in Moby
CVE-2026-61712

2.3LOW

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
19 August 2026

What is CVE-2026-61712?

BuildKit, a Moby toolkit for converting source code to build artifacts, is susceptible to a vulnerability that allows reading of attacker-controlled /etc/passwd and /etc/group files without limits. This flaw occurs during the user ID resolution process, whereby a malicious base image or build can supply oversized files. This behavior leads to excessive memory consumption and can ultimately terminate the BuildKit daemon (buildkitd) due to out-of-memory errors. The issue has been rectified in version 0.31.1.

Affected Version(s)

buildkit < 0.31.1

References

https://github.com/moby/buildkit/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/moby/buildkit/commit/408266e4ba254ceca...
x_refsource_MISC
https://github.com/moby/buildkit/commit/69a3924648e485acb...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.