Denial of Service Vulnerability in BuildKit by Moby
CVE-2026-93321

6.9MEDIUM

Key Information:

Vendor

Moby

Status
Buildkit
Vendor
CVE Published:
5 October 2026

What is CVE-2026-93321?

A vulnerability in Moby's BuildKit allows a malicious frontend to submit a crafted LLB definition, leading to a panic in the buildkitd service. This results in abrupt termination of all active builds running on that daemon, potentially disrupting the development workflow and causing significant downtime.

Affected Version(s)

BuildKit 0 <= 0.33.0

References

https://github.com/moby/buildkit/security/advisories/GHSA...
vendor-advisory
https://github.com/moby/buildkit/releases/tag/v0.33.1
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Haoxiang Yan (https://github.com/Yanhaoxi)
.