71 matches found
CVE-2026-61712
A flaw was found in BuildKit. A remote attacker could provide a malicious base image or build with oversized /etc/passwd and /etc/group files. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them without an upper bound, leading to excessive memory...
GHSA-72X6-4J93-7W86 BuildKit has a possible runtime DoS via unbounded group parsing
Impact Maliciously crafted base image or build can cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory OOM kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: kubevela, kubernetes-fips, kubernetes, rancher-webhook-fips, up, prometheus-adapter, metrics-server-fips, k3s, rancher-webhook, kube-oidc-proxy, buildkitd, caddy...
GO-2024-2492 vulnerabilities
Vulnerabilities for packages: docker, kubescape, conftest-fips, skaffold, trivy, zot, kaniko, guac, conftest, scorecard, buildkitd...
GO-2024-2493 vulnerabilities
Vulnerabilities for packages: docker, kubescape, conftest-fips, skaffold, trivy, zot, kaniko, guac, conftest, scorecard, buildkitd...
GO-2024-2491 vulnerabilities
Vulnerabilities for packages: skopeo, cadvisor, k3d, k9s, kaniko, grype, zot, wolfictl, newrelic-infrastructure-agent, nerdctl, kubernetes, k3s, syft, buildkitd, docker, trivy, runc, kots, kubescape, zarf, skaffold, podman, ctop...
GO-2024-2494 vulnerabilities
Vulnerabilities for packages: docker, kubescape, conftest-fips, skaffold, trivy, zot, kaniko, guac, conftest, scorecard, buildkitd...
GO-2024-2497 vulnerabilities
Vulnerabilities for packages: docker, kubescape, conftest-fips, skaffold, trivy, zot, kaniko, guac, conftest, scorecard, buildkitd...
GO-2025-4108 vulnerabilities
Vulnerabilities for packages: tekton-pipelines, headlamp, rancher-helm, tekton-pipelines-fips, gatekeeper, gitlab-operator-fips, opa-fips, wolfictl, rancher-agent, trivy-operator-fips, nerdctl, chainctl, syft, chartmuseum-fips, neuvector-scanner, gogatekeeper, docker, cg, kots, beats,...
GO-2026-5758 vulnerabilities
Vulnerabilities for packages: headlamp, rancher-helm, gatekeeper, packer, wolfictl, rancher-agent, trivy-operator-fips, chainctl, syft, chartmuseum-fips, neuvector-scanner, zarf-fips, docker, tigera-operator, cg, kots, helm-exporter, linkerd2, amazon-ecs-agent-fips, docker-compose,...
GO-2024-2491 vulnerabilities
Vulnerabilities for packages: newrelic-infrastructure-agent, zot, zarf, wolfictl, buildkitd, kots, skopeo, trivy, k9s, skaffold, k3d, kaniko, cadvisor, kubescape, runc, syft, grype, kubernetes, docker, ctop, nerdctl, k3s, podman...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: buildkitd, up, caddy, prometheus-adapter, kubevela, k3s, kubernetes...
GO-2023-2412 vulnerabilities
Vulnerabilities for packages: flux-source-controller, newrelic-infrastructure-agent, melange, zot, helm, buildkitd, kubevela, kots, trivy, skaffold, cilium-cli, up, k3d, kaniko, k8sgpt, gitness, fuse-overlayfs-snapshotter, kubescape, grype, helm-push, flux-helm-controller, eksctl, ctop...
GO-2024-2494 vulnerabilities
Vulnerabilities for packages: docker, zot, trivy, conftest, skaffold, buildkitd, scorecard, kaniko, kubescape, guac...
GO-2024-2497 vulnerabilities
Vulnerabilities for packages: docker, zot, trivy, conftest, skaffold, buildkitd, scorecard, kaniko, kubescape, guac...
GO-2026-4377 vulnerabilities
Vulnerabilities for packages: flux-source-controller, sigstore-scaffolding, zot, zarf, buildkitd, falcoctl, vexctl, trivy-operator, kyverno-notation-aws, teleport, goreleaser, trivy, spire-server, skaffold, tflint, crossplane, cosign, ko, neuvector-sigstore-interface, tekton-chains,...
GO-2024-2492 vulnerabilities
Vulnerabilities for packages: docker, zot, trivy, conftest, skaffold, buildkitd, scorecard, kaniko, kubescape, guac...
GO-2024-2493 vulnerabilities
Vulnerabilities for packages: docker, zot, trivy, conftest, skaffold, buildkitd, scorecard, kaniko, kubescape, guac...
GO-2023-2331 vulnerabilities
Vulnerabilities for packages: kine, kubernetes-csi-external-resizer, temporal, buildkitd, docker-compose, cri-tools, volume-modifier-for-k8s, envoy-ratelimit, metrics-server, kubescape, kubevela, temporal-server, k3s, kubernetes...