GHSA-72x6-4j93-7w86

Source

https://github.com/advisories/GHSA-72x6-4j93-7w86

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-72x6-4j93-7w86/GHSA-72x6-4j93-7w86.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-72x6-4j93-7w86

Aliases

Downstream

CGA (85)

ECHO (1)

ECHO-b91e-82b4-59d9

MINI (43)

Published

2026-08-19T20:24:01Z

Modified

2026-09-10T03:51:13Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

BuildKit has a possible runtime DoS via unbounded group parsing

Details

Impact

Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

Patches

Issue is fixed in BuildKit v0.31.1+

Workarounds

Use trusted build sources.

References

This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

Database specific

{
    "cwe_ids":  [
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-19T20:24:01Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/moby/buildkit

Package

Name: github.com/moby/buildkit; View open source insights on deps.dev
Purl: pkg:golang/github.com/moby/buildkit

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.31.1

Database specific

last_known_affected_version_range

"<= 0.31.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-72x6-4j93-7w86/GHSA-72x6-4j93-7w86.json"