2.3

CVE-2026-61712: moby buildkit

CVSS: 2.3v4.0LowDeferred
AliasesCGA-27g8-m3xr-h7h9CGA-2hx6-p7jp-jw37CGA-2pv4-qrwp-xg3c
Published 19-08-2026Last modified 21-08-2026
Open JSON

Vulnerability summary

CVE-2026-61712 is a low (CVSS 2.3) vulnerability in moby buildkit. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.6% of scored vulnerabilities.

Overall risk
9/100
0100
Minimal · default modelHow is this calculated?
CVSS score
2.3/10
010
Low · v4.0 (CVE.org)
EPSS score
0.40%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:21761-1SUSE-SU-2026:23625-1CGA-WV54-VPGJ-V2JQ

Timeline

  1. 19-08-2026
    PublishedVulnerability first disclosed.
  2. 21-08-2026
    Last modifiedVulnerability information updated.

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

-0.01 pp

From 0.40% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard39 products
  • cloudbeat-8.17All versions (No fix recorded)
  • cloudbeat-9.2< 9.2.8-r19
  • cloudbeat-9.3< 9.3.8-r5
  • cloudbeat-9.4< 9.4.5-r3
  • cloudbeat-9.5< 9.5.1-r3
Wolfi13 products
  • conftest< 0.69.0-r3
  • dockerd-28All versions (No fix recorded)
  • guac< 1.1.0-r28
  • guacingest< 1.1.0-r28
  • guacone< 1.1.0-r28
Github.com/moby1 product
  • buildkit< 0.31.1
Moby1 product

4 vendors · 54 products

References

7 links