Bug 2519914 (CVE-2026-61712)

Summary: CVE-2026-61712 github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, akhatavk, akoudelk, alizardo, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, aruklets, asatyam, asdas, bniver, bparees, cahl, cdrage, crizzo, derez, dfreiber, dhanak, diagrawa, dkeler, doconnor, dpaolell, drosa, drow, dschmidt, dsimansk, dymurray, eborisov, eglynn, flucifre, gmeno, gparvin, groman, gtanzill, hasun, ibolton, jburrell, jbuscemi, jcantril, jchui, jdelft, jfula, jhe, jjoyce, jlanda, jmatthew, jmontleo, jowilson, jprabhak, jpretori, jsamir, jschluet, jupierce, kaycoth, kbempah, kingland, kshier, ktsao, lball, lbragsta, lgamliel, lgarciaa, lhh, ljawale, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, msilmser, nboldt, ngough, nyancey, oaljalju, ometelka, pakotvan, pgaikwad, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, rushinde, sabiswas, sakbas, sausingh, sbratsla, sdawley, sghai, sidsharm, simaishi, slucidi, solenoci, sostapov, sseago, stcannon, sthirugn, suppawar, syedriko, teagle, thason, vereddy, veshanka, vkumar, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in BuildKit. A remote attacker could provide a malicious base image or build with oversized /etc/passwd and /etc/group files. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them without an upper bound, leading to excessive memory consumption. This can cause the buildkitd process to terminate due to out-of-memory errors, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2526309, 2526312, 2526314, 2526316, 2526317, 2526319, 2526320, 2526321, 2526323, 2526324, 2526310, 2526322    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-19 20:21:59 UTC 
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.