Threat database

CVE-2026-61801 is a medium severity vulnerability in the moby sys Go package before version 0.4.1. It involves uncontrolled resource consumption when parsing Unix-style user and group database files such as /etc/passwd or /etc/group. An attacker supplying a specially crafted file can cause excessive memory use, potentially terminating the affected process due to out-of-memory conditions. The issue is fixed in version 0.4.1. Mitigation includes upgrading to 0.4.1 or avoiding parsing untrusted user/group files.

CVE-2026-93321 is a medium severity vulnerability in moby BuildKit where improper validation of array indexes can cause the buildkitd daemon to panic and terminate. This occurs when a malicious frontend submits a crafted LLB definition, interrupting all builds running on that daemon.

CVE-2026-93315 is a medium severity vulnerability in moby BuildKit affecting versions from 0.31.0 up to but not including 0.33.1. It involves a time-of-check to time-of-use (TOCTOU) race condition when proxy networking with CA injection is enabled. This flaw allows a build process to modify its CA bundle before cleanup, potentially causing the cleanup operation to block, execute outside the intended build root filesystem, or fail without failing the build itself.

CVE-2026-93326 is a medium severity vulnerability in moby BuildKit affecting versions from 0 up to and including 0.33.0. It involves incorrect behavior order where validation occurs before canonicalization in a Git source build step. This flaw allows a malicious build definition to make a Git repository appear as if it originates from a different remote URL during cloning. However, stricter validations based on commit SHA, commit data, or signatures remain effective.

CVE-2026-93317 is a medium severity vulnerability in moby BuildKit where an unauthenticated attacker controlling a registry or OCI-layout blob source can supply blob contents that do not match the claimed digest. This can cause the snapshot to be cached incorrectly and reused in subsequent builds, compromising the integrity of build inputs. The affected versions are from 0.28.0 up to but not including 0.33.1.

CVE-2026-93316 is a high-severity vulnerability in moby BuildKit where starting the daemon with the --cdi-disabled option can cause a NULL pointer dereference, leading to a daemon panic if builds attempt to use CDI devices. This can occur either accidentally or through malicious actions. The affected versions are all BuildKit versions from 0 up to but not including 0.33.1.

CVE-2026-93320 is a medium severity vulnerability in moby BuildKit where the system may be tricked into performing file operations on special file inodes instead of regular files. This can cause operations to be blocked or, on rootful workers, allow unintended access to host devices. The issue arises from a confused deputy scenario where BuildKit mishandles file types during processing.

CVE-2026-93319 is a medium severity vulnerability in moby BuildKit versions up to 0.33.0. It involves unsynchronized access to shared data in a multi-threaded context, where a malicious external BuildKit frontend can send internal API requests that may cause a data race leading to a daemon panic.

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.

CVE-2026-93323 is a medium severity vulnerability in moby BuildKit where the Dockerfile frontend loads Dockerfile and .dockerignore files into memory without size limits. This can cause excessive memory allocation if a build context contains an oversized file, potentially exhausting memory and terminating the buildkitd daemon, disrupting other builds. The issue affects versions up to 0.33.0 and is fixed by rejecting files larger than 16 MiB.

CVE-2026-93322 is a medium severity vulnerability in moby BuildKit where improper validation of an array index can cause the buildkitd daemon to panic and terminate. This results in interruption of all builds running on the affected daemon. The vulnerability affects versions from 0 up to and including 0.33.0. There is no information about available patches or exploits in the wild.

CVE-2026-75593 is a path traversal vulnerability in moby buildkit prior to version 0.31.2. It allows a custom client with valid BuildKit control API permissions to craft an upload request that escapes the BuildKit-controlled state directory. This issue is fixed in version 0.31.2.

CVE-2026-61711 is an improper input validation vulnerability in moby buildkit prior to version 0.31.1. A crafted build request with an invalid SecurityMode value could cause the build container to run without Seccomp and AppArmor protections, although Linux capabilities remained restricted. This issue is fixed in version 0.31.1.

CVE-2026-61712 is a low-severity vulnerability in moby buildkit prior to version 0.31.1. The issue involves BuildKit reading attacker-controlled /etc/passwd and /etc/group files without limits while resolving user and group identifiers. Maliciously crafted oversized files can exhaust memory and cause the buildkitd process to terminate due to out-of-memory conditions. This vulnerability has been fixed in version 0.31.1.

BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation on the host.

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory.

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc.

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images