CVE-2026-121522 PUBLISHED

Possible panic from Git source resolver

Assigner: Docker
Reserved: 03.11.2026 Published: 03.11.2026 Updated: 03.11.2026

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 6.7

Attacker-controlled build input processed by a user

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	Active

Attacker-controlled build input processed by a user

CVSS 4.0

Product Status

Vendor	moby
Product	BuildKit
Versions	Default: unaffected affected from 0.26.0 to 0.34.2 (excl.)

Workarounds

Avoid untrusted build definitions. Only specific builds using Git dependencies trigger this issue.

Solutions

Upgrade BuildKit to v0.34.2 or later.

References

https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj

Problem Types

CWE-476: NULL Pointer Dereference CWE