CVE-2026-121522: 
Docker vulnerability analysis and mitigation

CVE-2026-121522 is a Denial of Service vulnerability in Moby BuildKit, the toolkit for building container images, caused by a possible panic in the Git source resolver. Affecting versions v0.26.0 through v0.34.1, a crafted build definition that resolves metadata for the same Git source reference twice can trigger a panic and crash the BuildKit daemon, interrupting all builds handled by that instance. The issue was disclosed on November 3, 2026, and fixed in v0.34.2. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-248 (Uncaught Exception), where the Git source resolver in BuildKit fails to handle the case where metadata for the same Git source reference is resolved more than once within a single build definition, leading to an unhandled panic. The attack vector is local, requiring user interaction (submission of a malicious build definition), with no privileges required. An attacker with the ability to submit build definitions — such as a developer or CI/CD pipeline user — can craft a Dockerfile or LLB definition that references the same Git source twice, triggering the daemon crash (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a crash of the BuildKit daemon, causing a Denial of Service that interrupts all builds currently handled by that daemon instance. There is no impact on confidentiality or integrity — only availability is affected. In environments where a single BuildKit daemon serves multiple users or CI/CD pipelines, a crash could disrupt all concurrent build operations until the daemon is restarted (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.118%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and the ability to submit build definitions, limiting the attack surface to trusted or semi-trusted users in build environments (GitHub Advisory).

1. Identify target: Confirm the target environment is running BuildKit v0.26.0–v0.34.1 (e.g., via buildkitd --version or inspecting Docker/CI configuration).
2. Craft malicious build definition: Create a Dockerfile or LLB build definition that references the same Git source URL and reference (branch/tag/commit) in two separate ADD, COPY --from, or source steps, causing the resolver to fetch metadata for the same Git reference twice.
3. Submit the build: Trigger a build using the crafted definition via docker build, buildctl build, or a CI/CD pipeline that uses the vulnerable BuildKit daemon.
4. Daemon crash: The BuildKit daemon encounters a NULL pointer dereference or uncaught exception during duplicate Git metadata resolution, panics, and crashes, interrupting all active builds on that daemon (GitHub Advisory, Red Hat Bugzilla).

• Logs: BuildKit daemon logs (buildkitd logs or Docker daemon logs) showing a Go panic stack trace referencing the Git source resolver, followed by an unexpected daemon exit.
• Process: Sudden termination of the buildkitd process without a graceful shutdown signal; all in-progress builds reporting connection errors or failures simultaneously.
• Build Output: Build clients receiving errors such as failed to solve: rpc error: code = Unavailable or similar gRPC connection-lost errors immediately after a build referencing duplicate Git sources is submitted.

Upgrade BuildKit to v0.34.2 or later, which contains the fix for this vulnerability (GitHub Advisory). As a workaround, restrict the ability to submit build definitions to trusted users only, and avoid processing untrusted Dockerfiles or LLB definitions that reference Git sources. Auditing build definitions for duplicate Git source references before execution can also reduce risk (Red Hat Bugzilla).

The advisory was published by BuildKit maintainer tonistiigi on GitHub with a "Moderate" severity rating. Red Hat's Product Security team tracked the issue via Bugzilla with 117 CC'd users, indicating broad interest across Red Hat product lines that bundle BuildKit. No significant public social media discussion or independent researcher commentary has been observed beyond standard vulnerability aggregator coverage.