Most recent entries from all

bdu:2026-15383

2026-10-03T13:38:59.181935+00:00

bdu:2026-15383

Withdrawn: BELL-CVE-2026-61712 — CVE-2026-61712 does not affect BellSoft software

2026-10-03T13:38:59.181977+00:00

Withdrawn by the publisher.

EUVD-2026-357460

2026-10-03T13:38:59.182009+00:00

EUVD-2026-357460

fkie_cve-2026-61712

2026-10-03T13:38:59.182030+00:00

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

GHSA-72x6-4j93-7w86 — BuildKit has a possible runtime DoS via unbounded group parsing

2026-10-03T13:38:59.182083+00:00

Affected: Go: github.com/moby/buildkit

### Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

### Patches Issue is fixed in BuildKit v0.31.1+

### Workarounds Use trusted build sources.

### References This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

msrc_CVE-2026-61712 — BuildKit: Possible runtime DoS via unbounded group parsing

2026-10-03T13:38:59.182112+00:00

msrc_CVE-2026-61712

WID-SEC-W-2026-2111 — docker: Mehrere Schwachstellen

2026-10-03T13:38:59.182129+00:00

Ein Angreifer kann mehrere Schwachstellen in docker ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsmaßnahmen zu umgehen.