Vulnerability in moby BuildKit

[ Description ]Official description

The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund5 Oct 2026WID-SEC-2026-3741

  BuildKit: Multiple vulnerabilities Translated from German

  CVE-2026-93319CVE-2026-93318CVE-2026-93323+7 more CVEs

[ References ]References

• github.com/moby/buildkit/releases/tag/v0.33.1
• github.com/moby/buildkit/security/advisories/GHSA-mgqf-486f-49vp