🔐 CVE Alert

CVE-2026-93322

UNKNOWN 0.0

Malformed MergeOp can crash the BuildKit daemon

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

CWE CWE-129
Vendor moby
Product buildkit
Published Oct 5, 2026
Last Updated Oct 5, 2026
Stay Ahead of the Next One

Get instant alerts for moby buildkit

Be the first to know when new unknown vulnerabilities affecting moby buildkit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

moby / BuildKit
0 ≤ 0.33.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/moby/buildkit/security/advisories/GHSA-cv6p-7w7g-xjwq github.com: https://github.com/moby/buildkit/releases/tag/v0.33.1

Credits

Haoxiang Yan (https://github.com/Yanhaoxi)