EUVD-2026-46311Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with low privileges; AC:H reflects AT:P (specific conditions - client access required); availability-only impact from daemon crash.
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (Docker).
CVSS VectorVendor: Docker
Lifecycle Timeline
3DescriptionCVE.org
A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.
AnalysisAI
Denial of service in Docker BuildKit (moby/buildkit) allows a malicious or compromised client or frontend to crash the BuildKit daemon (buildkitd) by sending a specially crafted request that triggers an unhandled Go panic. The vulnerability affects all versions of moby/buildkit (CPE cpe:2.3:a:moby:buildkit:*). Any authenticated BuildKit client or frontend - including those operating in CI/CD pipelines, Kubernetes build nodes, or Docker Desktop environments - with network access to the daemon can exploit this to disrupt all concurrent and subsequent build operations. No public exploit is identified at time of analysis and the vulnerability has not been added to the CISA KEV catalog.
Technical ContextAI
BuildKit (moby/buildkit) is Docker's next-generation build system, responsible for executing Dockerfile and LLB (low-level build) instructions via a daemon process (buildkitd) that communicates with clients and frontends over gRPC. The root cause is CWE-20 (Improper Input Validation): the daemon does not sufficiently validate incoming requests from clients or frontends before processing them, allowing a crafted payload to trigger an unrecovered Go runtime panic, which terminates the daemon process entirely. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L) indicates the attack is network-accessible with low complexity but requires attack conditions to be present - specifically, the attacker must operate as a legitimate (authenticated) BuildKit client or frontend with connectivity to the daemon's gRPC endpoint. The affected CPE covers all versions of moby/buildkit.
RemediationAI
Consult the official Moby/BuildKit security advisory at https://github.com/moby/buildkit/security/advisories/GHSA-qx3x-mv6r-52p6 for the exact patched version and upgrade instructions, as a specific fix version was not independently confirmed from the available input data - the patch is described as available per vendor advisory. As a compensating control where immediate patching is not feasible, restrict network access to the buildkitd gRPC endpoint (default: unix socket or TCP on port 1234) to only trusted, known-good clients using firewall rules or network policy - this directly addresses the PR:L/AT:P attack surface by preventing untrusted clients from reaching the daemon. Additionally, run buildkitd behind a reverse proxy or gateway that enforces client authentication, and consider restarting the daemon automatically via a process supervisor (e.g., systemd with Restart=always) to reduce downtime from crashes. Note that automatic restart does not prevent repeated exploitation if the malicious client retains access.
Moby is an open source container framework developed by Docker Inc. Rated high severity (CVSS 8.7), this vulnerability i
Moby is an open source container framework developed by Docker Inc. Rated medium severity (CVSS 6.8), this vulnerability
moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger mult
An issue was discovered in Docker Moby before 17.06.0. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
Argument injection in Moby BuildKit lets a malicious Git source trigger crafted command invocation on the build host whe
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite
Path traversal in the BuildKit daemon allows a client with valid control API access to craft a malicious upload request
Moby) is an open source container framework developed by Docker Inc. Rated medium severity (CVSS 6.8), this vulnerabilit
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. Rated medium severity (
moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. Rated medium severi
Moby is an open-source project created by Docker to enable software containerization. Rated medium severity (CVSS 6.3),
Moby is an open-source project created by Docker to enable software containerization. Rated medium severity (CVSS 6.3),
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.0 | Affected |
| SUSE Linux Micro 6.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today