CVE-2026-61712: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-61712 is a Denial of Service (DoS) vulnerability in Moby BuildKit, a toolkit for converting source code to build artifacts. Prior to version 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving usernames to user/group identifiers in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could supply oversized files that exhaust memory during user resolution, causing an out-of-memory (OOM) termination of the buildkitd process. All versions up to and including v0.31.0 are affected. The vulnerability was published on June 24, 2026, with a CVSS v4.0 base score of 2.3 (Low) (Github Advisory, BuildKit Release).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): BuildKit used os.Open to read /etc/passwd and /etc/group from container images with no size cap, allowing unbounded memory allocation during username-to-UID/GID resolution. The attack vector is network-based but requires attack prerequisites (AT:P) — specifically, the attacker must be able to supply a malicious base image or build configuration that includes oversized or crafted /etc/passwd or /etc/group files. The fix, applied in commits 408266e and 69a3924, introduces a limitedReadCloser wrapper capping reads at 10 MiB and rejecting non-regular files in both the OCI executor and the chown user resolver (Commit 408266e, Commit 69a3924). This vulnerability is a BuildKit variant of the containerd advisory GHSA-jpcc-p29g-p8mq (Github Advisory).

Successful exploitation causes memory exhaustion in the buildkitd process, resulting in an OOM kill and disruption of all ongoing and queued build operations. The impact is limited to availability of the build service — there is no confidentiality or integrity impact, and no lateral movement or data exposure risk is associated with this vulnerability. In CI/CD environments relying on BuildKit, a crash of buildkitd would halt all container image builds until the process is restarted (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to supply a malicious base image or build configuration, limiting the attacker pool to those with access to the build pipeline or image registry.

1. Prepare malicious base image: Craft a container image containing an oversized /etc/passwd or /etc/group file (e.g., a file significantly larger than 10 MiB filled with valid or arbitrary data) designed to exhaust memory when parsed.
2. Introduce image into build pipeline: Push the malicious image to a registry accessible by the target BuildKit instance, or reference it as a base image (FROM malicious-image) in a Dockerfile submitted to the target build environment.
3. Trigger user resolution: Initiate a build that causes BuildKit to resolve a username or group from the malicious image — for example, by using a USER instruction or a COPY --chown=username directive in the Dockerfile.
4. Exhaust memory: BuildKit reads the oversized /etc/passwd or /etc/group file without bound via os.Open, consuming available memory until the OS OOM killer terminates the buildkitd process, disrupting all active builds (Github Advisory, Commit 408266e).

• Logs: OOM kill events in system logs (e.g., kernel: Out of memory: Kill process <buildkitd PID>) coinciding with a build using an external or untrusted base image.
• Process: Unexpected termination of the buildkitd process without a clear application-level error; repeated restarts of buildkitd correlated with specific build jobs.
• File System: Presence of unusually large /etc/passwd or /etc/group files (>10 MiB) within container image layers pulled from external registries.
• Network: Build jobs referencing unfamiliar or external base image registries immediately before buildkitd crashes.

Upgrade BuildKit to version v0.31.1 or later, which caps /etc/passwd and /etc/group reads at 10 MiB and rejects non-regular files during user resolution (BuildKit Release). As a workaround, restrict builds to trusted base images and build sources only, preventing untrusted images from being used in the build pipeline (Github Advisory). Additionally, consider applying OS-level memory limits (e.g., via cgroups) on the buildkitd process to reduce the blast radius of any memory exhaustion event.