CVE-2026-93323: CWE-789: Memory Allocation with Excessive Size Value in moby BuildKit
Description
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.
CVSS v4.0
Score 6.8medium
Affected software
moby
BuildKit
pkg:github/github.com/moby/buildkitRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in moby BuildKit involves the Dockerfile frontend loading Dockerfile and .dockerignore files from a build context into memory without imposing size limits. If a build context includes an excessively large file, BuildKit may allocate memory proportional to the file size, which can exhaust system memory and cause the buildkitd daemon to terminate. This termination disrupts other builds running on the same instance. The issue affects BuildKit versions from 0 up to and including 0.33.0. The fix implemented rejects files larger than 16 MiB to prevent excessive memory allocation.
Potential Impact
An attacker or user providing a build context with an oversized file can cause BuildKit to allocate excessive memory, leading to exhaustion of system memory and termination of the buildkitd daemon. This results in interruption of other builds on the same instance, causing denial of service conditions for build operations.
Mitigation Recommendations
A fix is available that rejects files larger than 16 MiB in the build context, preventing excessive memory allocation. Users should upgrade to a BuildKit version later than 0.33.0 where this fix is applied. Since this is not a cloud service, remediation depends on applying the fix in the affected BuildKit installations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Docker
- Date Reserved
- 2026-09-17T17:18:17.963Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac3e69c2cdf04f65628b479
Added to database: 10/05/2026, 18:04:12 UTC
Last enriched: 10/05/2026, 18:19:09 UTC
Last updated: 10/05/2026, 19:19:11 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.