CVE-2026-61712: BuildKit Denial of Service Vulnerability

CVE-2026-61712 Overview

CVE-2026-61712 affects BuildKit, the toolkit that converts source code into build artifacts. Versions prior to 0.31.1 read attacker-controlled /etc/passwd and /etc/group files without an upper size limit during username-to-UID or group-to-GID resolution. The vulnerable code paths reside in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build definition can supply oversized files that exhaust memory and terminate the buildkitd process. Version 0.31.1 resolves the issue by bounding the size of parsed identity files. This vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A crafted base image can force buildkitd into out-of-memory termination, disrupting continuous integration pipelines and shared build infrastructure.

Affected Products

Moby BuildKit versions prior to 0.31.1
Container build systems and CI/CD pipelines that consume untrusted base images through BuildKit
Downstream projects embedding vulnerable BuildKit releases (for example, docker buildx and Buildpacks integrations)

Discovery Timeline

2026-08-19 - CVE-2026-61712 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-61712

Vulnerability Analysis

BuildKit resolves symbolic usernames and group names to numeric identifiers at multiple stages of a build. The resolution routines in executor/oci/user.go and solver/llbsolver/ops/user_linux.go open /etc/passwd and /etc/group from the target root filesystem and parse their entries. The implementation reads the full file into memory with no size ceiling.

An attacker who controls a base image or build context can replace these files with multi-gigabyte payloads. When buildkitd parses the crafted files, the Go runtime allocates until the process is killed by the kernel out-of-memory handler. The result is denial of service against the daemon and any concurrent builds it manages.

Root Cause

The root cause is missing input size validation on identity files sourced from an untrusted root filesystem. The parser used os.Open followed by unbounded reads instead of limiting the byte count. This aligns with [CWE-770], where a resource is allocated based on external input without enforcement of an upper bound.

Attack Vector

Exploitation requires the victim to build or execute an image that contains attacker-controlled /etc/passwd or /etc/group files. Multi-tenant build services and CI runners that accept external Dockerfiles or base images are the primary exposure. Successful exploitation kills buildkitd, dropping in-flight builds and potentially destabilizing shared build nodes.

// Patch: user: limit size of parsed passwd/group files
// File: executor/oci/user.go
 import (
 	"context"
+	"io"
 	"os"
 	"slices"
 	"strconv"

// File: solver/llbsolver/ops/user_linux.go
 package ops
 
 import (
+	"io"
 	"os"
 	"syscall"

Source: BuildKit commit 408266e4 and BuildKit commit 69a39246. The fix introduces the io package to wrap file reads with a bounded reader, capping the number of bytes accepted from /etc/passwd and /etc/group.

Detection Methods for CVE-2026-61712

Indicators of Compromise

Repeated out-of-memory terminations of the buildkitd process in system logs or dmesg output
Base images or build contexts containing /etc/passwd or /etc/group files that are anomalously large compared to typical Linux distributions
Failed or aborted builds correlated with sudden RSS growth on build workers

Detection Strategies

Monitor buildkitd process memory consumption and configure alerts on abnormal growth during image resolution
Inspect layers of untrusted base images for oversized identity files before allowing them into build pipelines
Correlate kernel OOM killer events with active build job identifiers to attribute crashes to specific images

Monitoring Recommendations

Enable structured logging on buildkitd and forward events to a centralized SIEM for anomaly analysis
Track BuildKit release versions across CI runners and flag hosts running versions earlier than 0.31.1
Baseline expected build memory footprints and alert on statistical deviations tied to user-resolution stages

How to Mitigate CVE-2026-61712

Immediate Actions Required

Upgrade BuildKit to version 0.31.1 or later on every build host and CI runner
Audit CI/CD workflows for use of untrusted base images and enforce image provenance controls
Restrict buildkitd execution to isolated worker nodes with memory limits enforced by cgroups

Patch Information

The fix is available in BuildKit release v0.31.1 and documented in GitHub Security Advisory GHSA-72x6-4j93-7w86. The corrective commits are 408266e4 and 69a39246, which wrap file reads with io.LimitReader to cap identity file sizes.

Workarounds

Use only trusted, signed base images from verified registries until patching is complete
Apply cgroup memory limits to the buildkitd service so a single build cannot exhaust host memory
Reject build contexts that ship oversized /etc/passwd or /etc/group files through pre-build validation hooks

bash

# Verify installed BuildKit version and enforce a memory ceiling on buildkitd
buildctl --version

# Example systemd override to cap buildkitd memory (adjust to your environment)
sudo systemctl edit buildkit.service
# [Service]
# MemoryMax=4G
# MemoryHigh=3G
sudo systemctl daemon-reload
sudo systemctl restart buildkit.service