VYPR
← All advisories
Low severityNVD Advisory· Published Aug 19, 2026· Updated Sep 9, 2026

CVE-2026-61712

CVE-2026-61712

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/moby/buildkitGo
< 0.31.10.31.1

Affected products

48

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.