Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/moby/buildkit

9 known vulnerabilities (2 critical, 3 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 critical, 3 high, 3 medium, 1 low
Registry
pkg.go.dev

Advisories 9

  • CVE-2026-61711Medium 5.3

    BuildKit: Custom frontend could bypass Seccomp/AppArmor

    Affected: fixed in 0.31.1.

  • BuildKit: Possible runtime DoS via unbounded group parsing

    Affected: fixed in 0.31.1.

  • BuildKit Git URL subdir component can cause access to restricted files

    Affected: fixed in 0.28.1.

  • BuildKit vulnerable to malicious frontend causing file escape outside of storage root

    Affected: fixed in 0.28.1.

  • CVE-2024-23653Critical 9.8

    BuildKit interactive containers API does not validate entitlements check

    Affected: fixed in 0.12.5.

  • CVE-2024-23652Critical 10.0

    BuildKit possible host system access from mount stub cleaner

    Affected: fixed in 0.12.5.

  • BuildKit possible race condition with accessing subpaths from cache mounts

    Affected: fixed in 0.12.5.

  • CVE-2024-23650Medium 5.3

    BuildKit possible panic when incorrect parameters sent from frontend

    Affected: fixed in 0.12.5.

  • CVE-2023-26054Medium 6.5

    Credentials inlined to Git URLs could end up in provenance attestation in BuildKit

    Affected: from 0.10.0, fixed in 0.11.4.