139 matches found
CLEANSTART-2026-DA21677 go command may execute unexpected commands when operating in untrusted VCS repositories
Security vulnerability affects the buildkitd package. The go command may execute unexpected commands when operating in untrusted VCS repositories...
CLEANSTART-2026-RQ84574 net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines
Security vulnerability affects the buildkitd package. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines...
CLEANSTART-2026-OM64011 On Unix platforms, when listing the contents of a directory using File
Security vulnerability affects the buildkitd package. On Unix platforms, when listing the contents of a directory using File...
CLEANSTART-2026-GK03402 Actions which insert URLs into the content attribute of HTML meta tags are not escaped
Security vulnerability affects the buildkitd package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...
CVE-2026-53495 vulnerabilities
Vulnerabilities for packages: fuse-overlayfs-snapshotter, eksctl, spegel, tigera-operator, datadog-agent, steampipe, helm, trivy, dagger, nerdctl, wolfictl, rancher, docker-compose, k9s, kube-arangodb, zot, kargo, helm-operator, cluster-api-helm-controller, chartmuseum, k8ssandra-client,...
GHSA-7JXH-36Q5-GCQV vulnerabilities
Vulnerabilities for packages: fuse-overlayfs-snapshotter, eksctl, spegel, tigera-operator, datadog-agent, steampipe, helm, trivy, dagger, nerdctl, wolfictl, rancher, docker-compose, k9s, kube-arangodb, zot, kargo, helm-operator, cluster-api-helm-controller, chartmuseum, k8ssandra-client,...
CVE-2026-61712
A flaw was found in BuildKit. A remote attacker could provide a malicious base image or build with oversized /etc/passwd and /etc/group files. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them without an upper bound, leading to excessive memory...
GHSA-72X6-4J93-7W86 BuildKit has a possible runtime DoS via unbounded group parsing
Impact Maliciously crafted base image or build can cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory OOM kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build...
CVE-2026-61712
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in...
PT-2026-80242
Impact Maliciously crafted base image or build can cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory OOM kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build...
GO-2024-2493 vulnerabilities
Vulnerabilities for packages: trivy, conftest, docker, buildkitd, guac, kaniko, skaffold, kubescape, zot, conftest-fips, scorecard...
GO-2024-2494 vulnerabilities
Vulnerabilities for packages: trivy, conftest, docker, buildkitd, guac, kaniko, skaffold, kubescape, zot, conftest-fips, scorecard...
GO-2024-2497 vulnerabilities
Vulnerabilities for packages: trivy, conftest, docker, buildkitd, guac, kaniko, skaffold, kubescape, zot, conftest-fips, scorecard...
GO-2024-2491 vulnerabilities
Vulnerabilities for packages: k3d, nerdctl, docker, buildkitd, k9s, kaniko, podman, kubernetes, cadvisor, kots, skopeo, skaffold, kubescape, zarf, trivy, syft, wolfictl, runc, newrelic-infrastructure-agent, zot, k3s, grype, ctop...
GO-2024-2492 vulnerabilities
Vulnerabilities for packages: trivy, conftest, docker, buildkitd, guac, kaniko, skaffold, kubescape, zot, conftest-fips, scorecard...
GO-2023-2113 vulnerabilities
Vulnerabilities for packages: rancher-webhook-fips, kubernetes-fips, metrics-server-fips, up, buildkitd, rancher-webhook, kubevela, kubernetes, kube-oidc-proxy, prometheus-adapter, k3s, caddy...
GO-2025-4108 vulnerabilities
Vulnerabilities for packages: fuse-overlayfs-snapshotter, gitlab-rails-ce, neuvector-scanner-fips, rancher-agent, consul-k8s, chainctl, nerdctl, docker-cli-buildx, kaniko, manifest-tool, melange, kube-arangodb, kots, tekton-pipelines-fips, k9s-fips, helm-push, livekit-cli, rancher-helm,...
GO-2026-5758 vulnerabilities
Vulnerabilities for packages: fuse-overlayfs-snapshotter, gitlab-rails-ce, kgateway-fips, neuvector-scanner-fips, helm-exporter, scorecard, rancher-agent, consul-k8s, chainctl, docker, docker-cli-buildx, kaniko, manifest-tool, kube-arangodb, chaos-mesh, kots, crossplane, k9s-fips, helm-push,...