CVE-2026-61712: 
Docker vulnerability analysis and mitigation

CVE-2026-61712 is a Denial of Service (DoS) vulnerability in Moby BuildKit, a toolkit for converting source code to build artifacts. Prior to version 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving usernames to user/group identifiers in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could supply oversized files that exhausted memory during user resolution, causing an out-of-memory (OOM) termination of the buildkitd process. All versions up to and including v0.31.0 are affected. The vulnerability was published on June 24, 2026, and carries a CVSS v4.0 base score of 2.3 (Low) (Github Advisory, BuildKit Release).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): BuildKit used os.Open to read /etc/passwd and /etc/group from container images with no size cap, allowing unbounded memory allocation during username-to-UID/GID resolution. The vulnerability exists in two code paths — the OCI executor (executor/oci/user.go) and the chown user resolver (solver/llbsolver/ops/user_linux.go). Exploitation requires an attacker to supply a malicious base image or build configuration containing an oversized /etc/passwd or /etc/group file; when BuildKit processes this image and resolves user identities, memory is exhausted and the buildkitd daemon is killed by the OS OOM killer. The fix caps reads at 10 MiB and rejects non-regular files in both affected code paths (Github Advisory, Patch Commit 408266e). This vulnerability is a BuildKit variant of the containerd advisory GHSA-jpcc-p29g-p8mq.

Successful exploitation causes an availability impact limited to the buildkitd process: the daemon is terminated via OOM kill, disrupting all ongoing and queued build operations. There is no confidentiality or integrity impact — the vulnerability cannot be used to exfiltrate data or modify system state. The blast radius is confined to the build environment; however, in CI/CD pipelines where buildkitd is a critical service, its termination could disrupt automated build and deployment workflows (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.404% (34th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to influence the base image or build configuration used by a target BuildKit instance, which limits the attacker pool to those with access to the build supply chain.

1. Craft a malicious base image: Create a container image containing an oversized /etc/passwd or /etc/group file (e.g., a file exceeding tens or hundreds of megabytes filled with valid or arbitrary entries).
2. Publish or inject the image: Push the malicious image to a registry accessible by the target BuildKit environment, or supply it as a base image in a Dockerfile or build configuration.
3. Trigger a build: Cause the target BuildKit instance to initiate a build using the malicious base image — for example, by submitting a docker build or equivalent command that references the crafted image.
4. Trigger user resolution: Ensure the build includes a step that causes BuildKit to resolve a username or group name (e.g., a USER instruction in the Dockerfile), which forces BuildKit to read /etc/passwd or /etc/group from the image.
5. Memory exhaustion: BuildKit reads the oversized file without bounds, exhausting available memory and causing the OS to OOM-kill the buildkitd process, resulting in a denial of service (Github Advisory, Patch Commit 408266e).

• Logs: OOM kill events in system logs (e.g., kernel: Out of memory: Kill process <pid> (buildkitd) in /var/log/syslog or dmesg) coinciding with a build operation.
• Process: Unexpected termination of the buildkitd process; absence of the buildkitd daemon after a build involving an external or untrusted base image.
• File System: Presence of unusually large /etc/passwd or /etc/group files (exceeding 10 MiB) within pulled container image layers in the BuildKit cache directory.
• Network: Pulls of unfamiliar or unexpected base images from external registries immediately preceding buildkitd crashes.

Upgrade BuildKit to version v0.31.1 or later, which caps /etc/passwd and /etc/group reads at 10 MiB and rejects non-regular files in both the OCI executor and chown user resolver (BuildKit Release, Github Advisory). As a workaround prior to patching, restrict builds to trusted base images and build sources only. Additionally, consider applying OS-level memory limits (e.g., cgroups) to the buildkitd process to reduce the system-wide impact of any memory exhaustion event.