—
GO-2026-6256
BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
Quick fix
GO-2026-6256 — github.com/moby/buildkit: upgrade to the fixed version with the command below.
go get github.com/moby/buildkit@v0.31.1Details
BuildKit has a possible runtime DoS via unbounded group parsing in github.com/moby/buildkit
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/moby/buildkit
Introduced in:
0 Fixed in: 0.31.1 Fix
go get github.com/moby/buildkit@v0.31.1 References
- https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86 [ADVISORY]
- https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1 [FIX]
- https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255 [FIX]
- https://github.com/moby/buildkit/releases/tag/v0.31.1 [WEB]