github.com/moby/buildkit vulnerabilities (Go)

9 vulnerabilities.

• github.com/moby/buildkit Go BuildKit: Custom frontend could bypass Seccomp/AppArmor CVE-2026-61711 Fix available 5.3 MediumAugust 19, 2026
• github.com/moby/buildkit Go BuildKit: Possible runtime DoS via unbounded group parsing CVE-2026-61712 Fix available 2.3 LowAugust 3, 2026
• github.com/moby/buildkit Go BuildKit Git URL subdir component can cause access to restricted files CVE-2026-33748 Fix available 8.2 HighMarch 26, 2026
• github.com/moby/buildkit Go BuildKit vulnerable to malicious frontend causing file escape outside of storage root CVE-2026-33747 Fix available 8.4 HighMarch 26, 2026
• github.com/moby/buildkit Go BuildKit interactive containers API does not validate entitlements check CVE-2024-23653 Public exploitFix available 9.8 CriticalJanuary 31, 2024
• github.com/moby/buildkit Go BuildKit possible host system access from mount stub cleaner CVE-2024-23652 Public exploitFix available 10.0 CriticalJanuary 31, 2024
• github.com/moby/buildkit Go BuildKit possible race condition with accessing subpaths from cache mounts CVE-2024-23651 Fix available 8.7 HighJanuary 31, 2024
• github.com/moby/buildkit Go BuildKit possible panic when incorrect parameters sent from frontend CVE-2024-23650 Fix available 5.3 MediumJanuary 31, 2024
• github.com/moby/buildkit Go Credentials inlined to Git URLs could end up in provenance attestation in BuildKit CVE-2023-26054 Fix available 6.5 MediumMarch 6, 2023