CVE-2026-93318

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

CVE-2026-93318

The BuildKit daemon is vulnerable to a cache poisoning issue where a malicious image can advertise DiffIDs from another image while containing different layer contents. Because BuildKit fails to validate that these DiffIDs match the actual layer contents, a daemon with a shared or persistent cach...

EUVD-2026-92532

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...

CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...