{"id":"CVE-2026-61712","title":"github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing (CVE-2026-61712)","summary":"A flaw was found in BuildKit. A remote attacker could provide a malicious base image or build with oversized /etc/passwd and /etc/group files. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","compliance_operator","confidential_compute_attestation","kernel_module_management_operator_for_red_hat_openshift","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","migration_toolkit_for_applications 8","migration_toolkit_for_containers","migration_toolkit_for_virtualization","multicluster_engine_for_kubernetes","node_healthcheck_operator","openshift_api_for_data_protection","openshift_developer_tools_and_services","openshift_lightspeed","openshift_serverless","openshift_service_mesh 3","pen_drive_powered_by_red_hat_lightspeed","power_monitoring_for_red_hat_openshift","advanced_cluster_management_for_kubernetes 2","ansible_automation_platform 2","build_of_kueue","ceph_storage 9","certification_program_for_red_hat_enterprise_linux 9","developer_hub","enterprise_linux 10","enterprise_linux 9","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_gitops","openshift_virtualization 4","openstack_platform 18.0","quay 3","trusted_artifact_signer","web_terminal"],"patched":["github.com/moby/buildkit 0.31.1"],"published":"2026-08-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T11:24:17+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-61712.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-61712.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-61712"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519914"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61712"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61712"},{"url":"https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1"},{"url":"https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255"},{"url":"https://github.com/moby/buildkit/releases/tag/v0.31.1"},{"url":"https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86"},{"url":"https://github.com/moby/buildkit"},{"url":"https://github.com/advisories/GHSA-72x6-4j93-7w86"}],"tags":["csaf","vex","red-hat","osv","go","nvd","ghsa"],"epss":0.00399,"epssPercentile":0.33899,"aliases":["GHSA-72x6-4j93-7w86","GO-2026-6256"],"ecosystem":"go","ingestedAt":"2026-08-19T20:44:41.424Z","slug":"CVE-2026-61712","body":"## Overview\n\nA flaw was found in BuildKit. A remote attacker could provide a malicious base image or build with oversized /etc/passwd and /etc/group files. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them without an upper bound, leading to excessive memory consumption. This can cause the buildkitd process to terminate due to out-of-memory errors, resulting in a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Compliance Operator, Confidential Compute Attestation, Kernel Module Management Operator for Red Hat Openshift, Logging Subsystem for Red Hat OpenShift, Logical Volume Manager Storage, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Logging Subsystem for Red Hat OpenShift, Logical Volume Manager Storage, Multicluster Engine for Kubernetes, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-61712.json)\n\n**github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing** — rated Moderate by Red Hat. Released 2026-08-19, updated 2026-10-16.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Compliance Operator\n- Confidential Compute Attestation\n- Kernel Module Management Operator for Red Hat Openshift\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- Multicluster Engine for Kubernetes\n- Node HealthCheck Operator\n- OpenShift API for Data Protection\n- OpenShift Developer Tools and Services\n- OpenShift Lightspeed\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- Pen Drive Powered by Red Hat Lightspeed\n- Power monitoring for Red Hat OpenShift\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Ansible Automation Platform 2\n- Red Hat Build of Kueue\n- Red Hat Ceph Storage 9\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift Virtualization 4\n- Red Hat OpenStack Platform 18.0\n- Red Hat Quay 3\n- Red Hat Trusted Artifact Signer\n- Red Hat Web Terminal\n\nNo fix planned:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Logging Subsystem for Red Hat OpenShift\n- Logical Volume Manager Storage\n- Multicluster Engine for Kubernetes\n- Node HealthCheck Operator\n- OpenShift Developer Tools and Services\n- OpenShift Service Mesh 3\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n- Compliance Operator\n- Confidential Compute Attestation\n- Kernel Module Management Operator for Red Hat Openshift\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Migration Toolkit for Virtualization\n- OpenShift API for Data Protection\n- OpenShift Lightspeed\n- OpenShift Serverless\n- Pen Drive Powered by Red Hat Lightspeed\n- Power monitoring for Red Hat OpenShift\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Build of Kueue\n- Red Hat Ceph Storage 9\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift GitOps\n- Red Hat OpenStack Platform 18.0\n- Red Hat Trusted Artifact Signer\n- Red Hat Web Terminal\n\nNot affected:\n\n- OpenShift Serverless\n- OpenShift Source-to-Image (S2I)\n- Red Hat Build of Podman Desktop\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nOut of support scope\n\nWorkarounds / mitigations:\n\n- To mitigate this issue, avoid building images from untrusted or unverified sources. If processing untrusted build definitions is necessary, consider implementing strict resource limits on build processes to prevent excessive memory consumption. This operational control helps contain the impact of potential memory exhaustion.\n\n## Package advisory (CVE-2026-61712)\n\nAffected packages:\n\n- `github.com/moby/buildkit < 0.31.1`\n\nPatched in:\n\n- `github.com/moby/buildkit 0.31.1`\n\nSource: https://osv.dev/vulnerability/GHSA-72x6-4j93-7w86","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222213,"id":"CVE-2026-61712","ts":1792065085175,"field":"cvss","old":null,"new":"5.5"},{"seq":222212,"id":"CVE-2026-61712","ts":1792065085175,"field":"severity","old":"low","new":"medium"}]}