CVE-2026-61712

[CVE catalog]

Severity

Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Jun 28, 2026, 10:00:00 PM UTC

Updated

Aug 19, 2026, 8:17:19 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.40% · Oct 25, 2026

A flaw was found in BuildKit. A remote attacker could provide a malicious base image or build with oversized /etc/passwd and /etc/group files. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them without an upper bound, leading to excessive memory consumption. This can cause the buildkitd process to terminate due to out-of-memory errors, resulting in a Denial of Service (DoS). github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing A moderate-impact denial of service flaw was found in BuildKit (github.com/moby/buildkit), a toolkit for converting source code into build artifacts that is vendored as a Go dependency by several Red Hat and community-maintained components. While resolving a user or group name to its identifier, BuildKit read the /etc/passwd and /etc/group files without an upper bound. An attacker able to supply a malicious base image or build input could provide oversized versions of these files, causing excessive memory consumption during user resolution and out-of-memory termination of the buildkitd process, resulting in a denial of service. Products that vendor the vulnerable BuildKit code are affected; for the affected community-maintained components in Fedora and EPEL, a fix is being pursued through the delegated maintenance process. Red Hat products whose builds do not contain the vulnerable code, such as Red Hat In-Vehicle OS podman and buildah, are not affected. Red Hat rates this flaw Moderate severity (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I/N/A:H), while the upstream CVE record assigns a Low severity score of 2.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L). The difference reflects upstream crediting the attack with partial prerequisites and required user interaction for a malicious base image or build, whereas the Red Hat assessment reflects a local, low-privilege build submission that directly causes high availability impact on the buildkitd process. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.