Moby BuildKit CVE-2026-121522

Exploitation requires the BuildKit daemon to process a build definition that resolves metadata for the same Git source reference twice - i.e., a build using Git dependencies structured to trigger the duplicate resolution path. Per the vendor, only very specific Git-dependency builds are affected, and avoiding untrusted build definitions is sufficient to avoid the issue. Limiting factors: the attack is local to the daemon (AV:L) and requires active user interaction (UI:A) - someone must submit/run the crafted definition - so it is not remotely self-triggering; impact is confined to availability (daemon panic) with no data exposure or code execution. The only complete fix is upgrading to v0.34.2.

This is a denial-of-service issue (CWE-476 null pointer dereference) in Moby BuildKit that crashes the build daemon; impact is availability only, with no confidentiality or integrity loss (CVSS 4.0 VC:N/VI:N/VA:H, score 6.7). The vendor-supplied CVSS 4.0 vector is local (AV:L) and requires active user interaction (UI:A), meaning the crash is triggered when the daemon processes a crafted build definition rather than through a remote unauthenticated path - so despite PR:N, exploitation is gated on getting a malicious build definition executed. No CISA KEV listing and no EPSS score were provided in the input, and no exploit/PoC reference beyond the GHSA advisory is present, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today priority is 'this_month' (not act_now/emergency), consistent with a self-contained DoS that needs attacker-influenced input. Net: this is a real but bounded availability risk - prioritize patching in normal maintenance, not as an emergency, since there is no data integrity/RCE angle and exploitation depends on processing an untrusted build definition.

An attacker supplies or convinces a victim to build an untrusted build definition (e.g., a malicious Dockerfile/LLB that resolves metadata for the same Git source reference twice). When the BuildKit daemon processes it, the Git source resolver dereferences a null pointer and panics, crashing the daemon and interrupting all builds it was handling. No public exploit code is identified; only the GHSA advisory is referenced.