Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index through malformed LLB op validation in the solver’s SourceOp and DiffOp handling. An attacker can crash buildkitd by submitting a crafted LLB definition with an input/dependency count mismatch. The...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the containerd and runc executor run paths. An attacker can make a build succeed, block cleanup, or leave cleanup operating outside the intended rootfs by mutating the injected CA bundl...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the Source.Identifier path in source/git/source.go and source/git/identifier.go. An attacker can make a build appear to use a different Git remote URL than the one in the...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to unbounded file reads in ReadEntrypoint, dockerIgnorePatterns, and NamedContext.load in frontend/dockerui/config.go and frontend/dockerui/namedcontext.go. An attacker can exhaust buildki...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to unbounded file reads in ReadEntrypoint, dockerIgnorePatterns, and NamedContext.load in frontend/dockerui/config.go and frontend/dockerui/namedcontext.go. An attacker can exhaust buildki...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via unvalidated image layer DiffIDs through the setBlob and snapshot identity handling in cache/blobs.go, cache/metadata.go, and cache/refs.go. An attacker can cause a later build to mount...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via unvalidated image layer DiffIDs through the setBlob and snapshot identity handling in cache/blobs.go, cache/metadata.go, and cache/refs.go. An attacker can cause a later build to mount...

Rocky Linux 8 [CIQ] Security Update: aardvark-dns / cockpit-podman / conmon / conmon-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2988)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242988 advisory. urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect CVE-2018-25091 golang: math/big.Rat: may cause a pani...

GO-2026-6256 BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit

BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in client/llb/exec.go and executor/oci/speclinux.go. An attacker can disable Seccomp and AppArmor protections for a build container by supplying a crafted build request with an invalid...

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in client/llb/exec.go and executor/oci/speclinux.go. An attacker can disable Seccomp and AppArmor protections for a build container by supplying a crafted build request with an invalid...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded group parsing in the user and group file handling code in executor/oci/user.go and solver/llbsolver/ops/userlinux.go. An attacker can exhaust memory and trigger an OO...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded group parsing in the user and group file handling code in executor/oci/user.go and solver/llbsolver/ops/userlinux.go. An attacker can exhaust memory and trigger an OO...

PT-2026-78679

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.31.1 Description BuildKit is a toolkit used to convert source code into build artifacts. A custom frontend can send a crafted build request containing an invalid SecurityMode value. The executor/oci/spec linux.go...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack when processing Git URL fragment subdir components. An attacker can access files outside the intended Git repository root by specifying a crafted subdir value in the URL fragment. Note: This is only exploitable if builds...

Security Bulletin: Vulnerabilities in Moby BuildKit affect IBM watsonx.data

Summary Moby BuildKit could allow a remote attacker to bypass security restrictions, allow a remote attacker to traverse directories on the system, or allow a remote attacker to gain elevated privileges on the system. These can affect IBM watsonx.data. Vulnerability Details CVEID:CVE-2024-23651...

Security Bulletin: Multiple Vulnerabilities in CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.4.1 Vulnerability Details CVEID:CVE-2023-4641 DESCRIPTION: shadow-maint shadow-utils could allow a local authenticated attacker to obtain sensitive information, caused by failing to clean the buffer used to store...