Most recent entries from all

bdu:2026-15383

Withdrawn: BELL-CVE-2026-61712 — CVE-2026-61712 does not affect BellSoft software

Withdrawn by the publisher.

EUVD-2026-357460

fkie_cve-2026-61712

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

GHSA-72x6-4j93-7w86 — BuildKit has a possible runtime DoS via unbounded group parsing

Affected: Go: github.com/moby/buildkit

### Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

### Patches Issue is fixed in BuildKit v0.31.1+

### Workarounds Use trusted build sources.

### References This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

msrc_CVE-2026-61712 — BuildKit: Possible runtime DoS via unbounded group parsing

msrc_CVE-2026-61712

WID-SEC-W-2026-2111 — docker: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in docker ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsmaßnahmen zu umgehen.