A flaw in BuildKit allows a malicious BuildKit client or frontend to craft a specially designed request that crashes the BuildKit daemon, resulting in denial of service. Exploitation requires the ability to supply a build definition, such as a Dockerfile with a custom #syntax frontend. The vulnerability does not permit remote code execution or data leakage. The issue is fixed upstream in BuildKit 0.31.2. Red Hat has already shipped the fixed BuildKit version in Hardened Images (Buildah, Podman, Trivy) and is assessing other products for updates. The vulnerability is tracked as CVE-2026-15792 and is rated high severity by Red Hat.

Successful exploitation causes the BuildKit daemon to crash, resulting in denial of service and unavailability of the BuildKit service. There is no impact on confidentiality or integrity, and no remote code execution is possible. The attack requires the ability to supply a build definition to BuildKit, which limits the attack surface to users who can initiate builds.

Red Hat has fixed this vulnerability upstream in BuildKit version 0.31.2. Hardened Images including Buildah, Podman, and Trivy already include the fixed version. Other affected Red Hat products will receive fixes in upcoming releases. Until patched, avoid building container images using BuildKit frontends from untrusted sources. Only use frontend images from trusted origins, specified via the #syntax directive or the --frontend option to buildctl build. Follow Red Hat's guidance for applying updates and errata.