Answer in brief
CVE-2026-61712 records a Low severity vulnerability in BuildKit: Possible runtime DoS via unbounded group parsing. The current sources do not mark it as known exploited. The current feed maps moby/buildkit (generic), github.com/moby/buildkit (go), github.com/moby/buildkit (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps moby/buildkit (generic), github.com/moby/buildkit (go), github.com/moby/buildkit (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| moby/buildkitgeneric | < 0.31.1 | Not reported |
| github.com/moby/buildkitgo | >=0 <0.31.1 | 0.31.1 |
| github.com/moby/buildkitgo | <=0.31.0 | 0.31.1 |
Published upstream
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 19, 2026
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.
Quoted source text, attributed separately from HOL analysis.