moby buildkit vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20244
3. 202622

Newest CVEs

• CVE-2026-121520

  Malicious client could set xattr value outside of BuildKit state directory

  Moby · BuildKit

  Medium4.5
• CVE-2026-121522

  Possible panic from Git source resolver

  moby · BuildKit

  Medium6.7
• CVE-2026-93321

  Malformed LLB file operation can crash buildkitd

  moby · BuildKit

  Medium6.9
• CVE-2026-93315

  BuildKit proxy CA cleanup can be disrupted by build steps

  moby · BuildKit

  Medium5.8
• CVE-2026-93326

  Crafted Git build source can bypass certain policy validation

  moby · BuildKit

  Medium6.0
• CVE-2026-93323

  Oversized Dockerfile or .dockerignore can exhaust buildkitd memory

  moby · BuildKit

  Medium6.8
• CVE-2026-93322

  Malformed MergeOp can crash the BuildKit daemon

  moby · BuildKit

  Medium6.9
• CVE-2026-93320

  BuildKit improperly handles special files in build snapshots

  moby · BuildKit

  Medium6.0
• CVE-2026-93319

  A malicious frontend can cause a daemon panic

  moby · BuildKit

  Medium5.7
• CVE-2026-93318

  Cache poisoning via unvalidated image layer DiffIDs

  moby · BuildKit

  High7.5