Every CVESearch/Get API key

CVE-2026-121522

Possible panic from Git source resolver

6.7 Medium

CVE-2026-121522 is a medium vulnerability (CVSS 6.7) in Moby Buildkit, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. No source names a fixed version.

What does this mean?
Severity
6.7 MediumCVSS 4.0, CVE List
Exploit chance
0.12%EPSS, 1st percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.12%Unchanged since Nov 4, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
podman
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podman-docker
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podman-machine
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podman-remote
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
podmansh
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
before 5:6.1.4-1.3.hum1
5:6.1.4-1.3.hum1
docker.io
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1.6.2~dfsg1-1ubuntu41.10.2-0ubuntu31.10.2-0ubuntu41.10.3-0ubuntu11.10.3-0ubuntu4
Show 19 moreShow less
1.10.3-0ubuntu51.10.3-0ubuntu61.11.2-0ubuntu5~16.041.12.1-0ubuntu13~16.04.11.12.3-0ubuntu4~16.04.21.12.6-0ubuntu1~16.04.11.13.1-0ubuntu1~16.04.217.03.2-0ubuntu2~16.04.118.06.1-0ubuntu1~16.04.218.06.1-0ubuntu1.2~16.04.118.09.2-0ubuntu1~16.04.118.09.5-0ubuntu1~16.04.218.09.7-0ubuntu1~16.04.118.09.7-0ubuntu1~16.04.418.09.7-0ubuntu1~16.04.518.09.7-0ubuntu1~16.04.618.09.7-0ubuntu1~16.04.718.09.7-0ubuntu1~16.04.9+esm118.09.7-0ubuntu1~16.04.9+esm2
None known
docker.io
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
1.13.1-0ubuntu617.03.2-0ubuntu117.03.2-0ubuntu317.03.2-0ubuntu517.12.1-0ubuntu1
Show 22 moreShow less
18.06.1-0ubuntu1~18.04.118.06.1-0ubuntu1.2~18.04.118.09.2-0ubuntu1~18.04.118.09.5-0ubuntu1~18.04.218.09.7-0ubuntu1~18.04.118.09.7-0ubuntu1~18.04.318.09.7-0ubuntu1~18.04.419.03.6-0ubuntu1~18.04.119.03.6-0ubuntu1~18.04.219.03.6-0ubuntu1~18.04.320.10.2-0ubuntu1~18.04.220.10.2-0ubuntu1~18.04.320.10.7-0ubuntu1~18.04.120.10.7-0ubuntu1~18.04.220.10.7-0ubuntu5~18.04.220.10.7-0ubuntu5~18.04.320.10.12-0ubuntu2~18.04.120.10.21-0ubuntu1~18.04.220.10.21-0ubuntu1~18.04.320.10.21-0ubuntu1~18.04.3+esm120.10.21-0ubuntu1~18.04.3+esm220.10.21-0ubuntu1~18.04.3+esm3
None known
docker.io
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
19.03.2-0ubuntu119.03.6-0ubuntu119.03.8-0ubuntu119.03.8-0ubuntu1.20.0419.03.8-0ubuntu1.20.04.1
Show 15 moreShow less
19.03.8-0ubuntu1.20.04.220.10.2-0ubuntu1~20.04.220.10.2-0ubuntu1~20.04.320.10.7-0ubuntu1~20.04.120.10.7-0ubuntu1~20.04.220.10.7-0ubuntu5~20.04.120.10.7-0ubuntu5~20.04.220.10.12-0ubuntu2~20.04.120.10.21-0ubuntu1~20.04.120.10.21-0ubuntu1~20.04.220.10.21-0ubuntu1~20.04.420.10.21-0ubuntu1~20.04.520.10.21-0ubuntu1~20.04.620.10.21-0ubuntu1~20.04.6+esm120.10.21-0ubuntu1~20.04.6+esm2
None known
docker.io-app
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
20.10.25-0ubuntu1~20.04.120.10.25-0ubuntu1~20.04.224.0.5-0ubuntu1~20.04.124.0.7-0ubuntu2~20.04.126.1.3-0ubuntu1~20.04.126.1.3-0ubuntu1~20.04.1+esm126.1.3-0ubuntu1~20.04.1+esm2
None known
docker.io
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
20.10.7-0ubuntu520.10.7-0ubuntu720.10.12-0ubuntu120.10.12-0ubuntu220.10.12-0ubuntu3
Show 11 moreShow less
20.10.12-0ubuntu3+gke1.24.120.10.12-0ubuntu420.10.21-0ubuntu1~22.04.220.10.21-0ubuntu1~22.04.320.10.21-0ubuntu1~22.04.520.10.21-0ubuntu1~22.04.620.10.21-0ubuntu1~22.04.720.10.21-0ubuntu1~22.04.7+esm120.10.21-0ubuntu1~22.04.7+esm220.10.21-0ubuntu1~22.04.820.10.21-0ubuntu1~22.04.8+esm1
None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
docker.io-app
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
20.10.25-0ubuntu1~22.04.120.10.25-0ubuntu1~22.04.224.0.5-0ubuntu1~22.04.124.0.7-0ubuntu2~22.04.126.1.3-0ubuntu1~22.04.1
Show 6 moreShow less
26.1.3-0ubuntu1~22.04.1+esm127.5.1-0ubuntu3~22.04.127.5.1-0ubuntu3~22.04.228.2.2-0ubuntu1~22.04.129.1.3-0ubuntu3~22.04.129.1.3-0ubuntu3~22.04.2
None known
docker.io
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
20.10.24+dfsg1-1ubuntu220.10.25+dfsg1-2ubuntu120.10.25+dfsg1-2ubuntu1+esm120.10.25+dfsg1-2ubuntu1+esm220.10.25+dfsg1-2ubuntu1.24.04.120.10.25+dfsg1-2ubuntu1.24.04.1+esm1
None known
docker.io-app
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
24.0.5-0ubuntu124.0.7-0ubuntu124.0.7-0ubuntu224.0.7-0ubuntu324.0.7-0ubuntu4
Show 8 moreShow less
24.0.7-0ubuntu4.126.1.3-0ubuntu1~24.04.126.1.3-0ubuntu1~24.04.1+esm127.5.1-0ubuntu3~24.04.127.5.1-0ubuntu3~24.04.228.2.2-0ubuntu1~24.04.129.1.3-0ubuntu3~24.04.129.1.3-0ubuntu3~24.04.2
None known
docker.io
Ubuntu:26.10
All versions, plus listed versions
27.5.1+dfsg4-2ubuntu128.5.2+dfsg4-5ubuntu1
None known
docker.io-app
Ubuntu:26.10
All versions, plus listed versions
29.1.3-0ubuntu429.1.3-0ubuntu529.1.3-0ubuntu629.7.2-0ubuntu1
None known
docker.io
Ubuntu:26.04:LTS
All versions, plus listed versions
26.1.5+dfsg1-9ubuntu127.5.1+dfsg4-1ubuntu127.5.1+dfsg4-2ubuntu1
None known
docker.io-app
Ubuntu:26.04:LTS
All versions, plus listed versions
28.2.2-0ubuntu129.1.2-0ubuntu129.1.3-0ubuntu129.1.3-0ubuntu229.1.3-0ubuntu329.1.3-0ubuntu429.1.3-0ubuntu4.1
None known

What each source reports

CVE List Score used6.7

Possible panic from Git source resolver

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Record
CVE-2026-121522
CVSS 4.0
6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-476
Updated
2026-11-06
EUVDEUVD-2026-1165376.7

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Record
EUVD-2026-116537
CVSS 4.0
6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-06
NVD6.7

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Record
CVE-2026-121522
CVSS 4.0
6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-476
Updated
2026-11-06
OSV6.7

Possible panic from Git source resolver

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Record
CVE-2026-121522
CVSS 4.0
6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-476
Updated
2026-11-07
OSVRHSA-2026:956117.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:95611
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2026-1215226.7

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Record
UBUNTU-CVE-2026-121522
CVSS 4.0
6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-05

History

History
RecordedChangedSources
affected, aliases, referencesCVE List, EUVD, NVD, OSV
affected, aliases, referencesOSV
aliases, referencesNVD, OSV
first indexedCVE List, EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 10 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open