docf-sec-check

DocF-Sec-Check Description DocF-Sec-Check helps to make your Dockerfile commands more secure. ScreenShot Done First-level security notification in the Dockerfile TODO List Correctly detect the Dockerfile. Second-level security notification in the Dockerfile. Security notification in Docker images...

vulnerable-container-hub

The OWASP Vulnerable Container Hub Project Background There are many repositories out there to provide vulnerable environments such as web applications, containers or virtual machines to those who want to learn security, since it helps not only students or someone who recently joined the field to...

checkov

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

cve-2010-1622_learning_environment

cve-2010-1622learningenvironment tomcat 6.0.26 Jdk1.8.45 This Project Include simple SpringMvc source code and a Dockerfile you can use to build the environment...

ReproducingCVEs_Akshath_Nagulapally

ReproducingCVEsAkshathNagulapally Reproducing the following CVEs with dockerfile:CVE-2024-33644 CVE-2024-34370 CVE-2024-22120...

CVE-2026-93323

A flaw was found in BuildKit. A local user with build permissions can trigger a Denial of Service DoS by submitting a build context containing an oversized Dockerfile or .dockerignore file. Because the Dockerfile frontend loads these files directly into memory without enforcing a size limit, an...

CVE-2026-112264

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-112264

BentoML versions through 1.4.39 are vulnerable to a Dockerfile instruction injection vulnerability (CWE-78). The root cause is the lack of proper sanitization of docker.env mapping keys rendered by the legacy base.j2 template, which allows attackers to embed newlines into the configuration. By pr...

EUVD-2026-104309

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2026-112264 BentoML through 1.4.39 Dockerfile Instruction Injection via docker.env Keys

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. Attackers can supply a crafted bentofile.yaml or imported bento...

CVE-2024-23653

syntax=docker.io/zdfa/evilerfile FROM alpine RUN grep Cap /proc/self/status sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. ➜ cp sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. + Building 5.3s 6/6 FINISHED...

Astra Linux – Vulnerability in docker.io-app

BuildKit is a toolkit for converting source code into build artifacts in an efficient, expressive, and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could exploit a feature that removes empty files created for the mountpoints, causing the file to be removed from...

Astra Linux – Vulnerability in Containerd

Containerd is an open-source container runtime. A bug was discovered in Containerd prior to versions 1.6.18 and 1.5.18, where supplementary groups were not set up properly within a container. If an attacker has direct access to a container and manipulates the supplementary group permissions, they...

SUSE CVE-2026-93323

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...

Linux Distros Unpatched Vulnerability : CVE-2026-93323

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversiz...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to unbounded file reads in ReadEntrypoint, dockerIgnorePatterns, and NamedContext.load in frontend/dockerui/config.go and frontend/dockerui/namedcontext.go. An attacker can exhaust buildki...

AZL-106824 CVE-2026-93323 affecting package moby-engine 25.0.3-20

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...

CVE-2026-93323

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...

UBUNTU-CVE-2026-93323

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which...