BuildKit versions before 0.31.1 improperly handle resource allocation when reading /etc/passwd and /etc/group files during user resolution in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. Specifically, there is no upper bound on the size of these files, allowing an attacker to supply oversized files that cause excessive memory consumption. This can lead to out-of-memory termination of the buildkitd process. The issue is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerability has a CVSS 4.0 base score of 2.3, indicating low severity. The problem is resolved in BuildKit version 0.31.1.

An attacker can cause denial of service by exhausting memory resources of the buildkitd process through supplying oversized /etc/passwd or /etc/group files during user resolution. This results in termination of the build process. There is no indication of privilege escalation or code execution. The impact is limited to availability disruption of the buildkitd service.

Upgrade BuildKit to version 0.31.1 or later, where this issue is fixed. Since the vendor advisory confirms the fix in 0.31.1, applying this update fully mitigates the vulnerability. No other mitigation or workaround is indicated.