---
id: CVE-2026-61712
aliases:
  - GHSA-72x6-4j93-7w86
  - GO-2026-6256
title: BuildKit has a possible runtime DoS via unbounded group parsing
summary: BuildKit has a possible runtime DoS via unbounded group parsing
severity: low
vendor: moby
product: github.com/moby/buildkit
ecosystem: go
affected:
  - github.com/moby/buildkit < 0.31.1
patched:
  - github.com/moby/buildkit 0.31.1
published: '2026-08-19'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:13.226978985Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-72x6-4j93-7w86'
references:
  - url: 'https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86'
  - url: >-
      https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1
  - url: >-
      https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255
  - url: 'https://github.com/moby/buildkit'
  - url: 'https://github.com/moby/buildkit/releases/tag/v0.31.1'
  - url: 'https://github.com/advisories/GHSA-72x6-4j93-7w86'
tags:
  - osv
  - go
  - nvd
  - ghsa
epss: 0.00528
epssPercentile: 0.42184
cwe:
  - CWE-770
ingestedAt: '2026-08-19T20:44:41.424Z'
---

## Overview

### Impact
Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

### Patches
Issue is fixed in BuildKit v0.31.1+

### Workarounds
Use trusted build sources.

### References
This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

## Affected packages

- `github.com/moby/buildkit < 0.31.1`

## Remediation

Upgrade to a patched release:

- `github.com/moby/buildkit 0.31.1`