CVE-2026-93323: BuildKit Dockerfile Frontend DOS Vulnerability

CVE-2026-93323 Overview

CVE-2026-93323 affects the BuildKit Dockerfile frontend used by buildkitd. The frontend loaded Dockerfile and .dockerignore files from a build context into memory without enforcing a size limit. A build context containing an oversized file causes buildkitd to allocate memory proportional to the file size. The allocation can exhaust available memory and terminate the daemon, interrupting other concurrent builds on the same instance. The issue is classified under CWE-789: Memory Allocation with Excessive Size Value. Maintainers resolved the flaw in BuildKit v0.33.1 by rejecting such files above 16 MiB.

Critical Impact
A local user with build submission privileges can crash buildkitd and disrupt all co-tenant builds on the shared instance.

Affected Products

Moby BuildKit (buildkitd) Dockerfile frontend prior to v0.33.1
Container build pipelines that embed BuildKit as a shared build daemon
Multi-tenant CI/CD runners relying on a single buildkitd instance

Discovery Timeline

2026-10-05 - CVE-2026-93323 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-93323

Vulnerability Analysis

The BuildKit Dockerfile frontend parses two files from the build context before executing build steps: the Dockerfile and the .dockerignore. The frontend read both files into memory in full without validating their size. An attacker with permission to submit a build context could include a crafted multi-gigabyte Dockerfile or .dockerignore file. When buildkitd processed the context, the Go runtime allocated a buffer proportional to the file size, consuming available RAM on the host. The resulting out-of-memory condition terminated the buildkitd process. All concurrent builds on the same daemon failed as a side effect. The vulnerability does not grant code execution or data access, but it enables build-infrastructure disruption on shared hosts.

Root Cause

The root cause is missing input validation on file size during context ingestion. The frontend trusted the build context to provide reasonably sized metadata files. Without a maximum size check, the allocation path scaled linearly with attacker-controlled input, matching the pattern described in CWE-789.

Attack Vector

Exploitation requires local build-submission access to a buildkitd instance. A low-privileged user supplies a build context containing an oversized Dockerfile or .dockerignore. On submission, the daemon allocates memory for the file and crashes. Shared CI runners, Kubernetes build pods, and developer workstations hosting multi-tenant builds are the primary exposure points. Technical details are available in the GitHub Security Advisory GHSA-mgqf-486f-49vp.

Detection Methods for CVE-2026-93323

Indicators of Compromise

Unexpected buildkitd process terminations correlated with OOM-killer entries in dmesg or /var/log/messages
Build contexts containing Dockerfile or .dockerignore files larger than 16 MiB
Sudden spikes in resident memory on build hosts immediately preceding daemon exit

Detection Strategies

Monitor buildkitd exit codes and restart frequency through the container orchestrator or systemd journal
Inspect inbound build contexts at the CI layer and flag Dockerfile or .dockerignore entries exceeding a defined size threshold
Correlate kernel OOM events with the pid or cgroup of the BuildKit daemon

Monitoring Recommendations

Alert on repeated buildkitd crashes from the same tenant or user identity within a short window
Track per-build memory high-water marks and flag outliers for review
Collect host memory pressure metrics and tie them to BuildKit API call logs

How to Mitigate CVE-2026-93323

Immediate Actions Required

Upgrade BuildKit to v0.33.1 or later, which rejects Dockerfile and .dockerignore files above 16 MiB
Restrict buildkitd access to trusted users and automation accounts
Isolate build workloads per tenant using separate daemons or ephemeral runners

Patch Information

The fix is included in BuildKit v0.33.1. Release notes and binaries are available in the GitHub BuildKit Release v0.33.1. The patch adds an explicit size check that rejects context metadata files exceeding 16 MiB before memory allocation.

Workarounds

Enforce build-context size limits at the CI pipeline before submission to buildkitd
Run buildkitd under a cgroup memory limit so a single OOM does not evict other critical workloads
Reject uploads containing Dockerfile or .dockerignore entries over 16 MiB using a pre-ingest validation hook

bash

# Configuration example
# Run buildkitd under a systemd memory limit to contain OOM impact
sudo systemctl set-property buildkitd.service MemoryMax=4G MemoryHigh=3G
sudo systemctl daemon-reload
sudo systemctl restart buildkitd

# Verify installed BuildKit version is patched
buildctl --version