buildkit
- Software type
- Build tool
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/20/2026, buildkit recorded 13 security vulnerabilities in the last 90 days, of which 3 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of buildkit and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-93321Malformed LLB file operation can crash buildkitdCVE-2026-93315BuildKit proxy CA cleanup can be disrupted by build stepsCVE-2026-93326Crafted Git build source can bypass certain policy validationCVE-2026-93323Oversized Dockerfile or .dockerignore can exhaust buildkitd memoryCVE-2026-93322Malformed MergeOp can crash the BuildKit daemon| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-93321Malformed LLB file operation can crash buildkitd | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-93315BuildKit proxy CA cleanup can be disrupted by build steps | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-93326Crafted Git build source can bypass certain policy validation | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-93323Oversized Dockerfile or .dockerignore can exhaust buildkitd memory | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-93322Malformed MergeOp can crash the BuildKit daemon | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-93320BuildKit improperly handles special files in build snapshots | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-93319A malicious frontend can cause a daemon panic | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-93318Cache poisoning via unvalidated image layer DiffIDs | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityHigh |
|---|
CVE-2026-93317Container blob cache can accept unverified content | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-93316Starting daemon with --cdi-disabled flag can lead to panic on specific builds | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityHigh |
|---|
25 Results | Page 1 of 3