Read the docs
TI-2024-15669 Aliases CVE-2024-23650GHSA-9p26-698r-w4hx

BuildKit possible panic when incorrect parameters sent from frontend

Priority LOW 32CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0114 66th percentileScored 2026-11-07
Fix Partial buildkit (moby): 0.12.5github.com/moby/buildkit (Go): 0.12.5Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mobybuildkitbefore 0.12.50.12.5Patch availableCNA
—github.com/moby/buildkit (Go)before 0.12.50.12.5Patch availableGHSA-9p26-698r-w4hx
  • buildkit Vendormoby Affected before 0.12.5 Fixed in 0.12.5 Patch available CNA
  • github.com/moby/buildkit (Go) Vendor— Affected before 0.12.5 Fixed in 0.12.5 Patch available GHSA-9p26-698r-w4hx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:*before 0.12.5VulnerableMobyproject
  • cpe:2.3:a:mobyproject:buildkit:*:*:*:*:*:*:*:* Versions before 0.12.5 Vulnerable ·Mobyproject

Remediation

  • Fix · CNA buildkit (moby) Fixed in 0.12.5
  • Fix · GHSA-9p26-698r-w4hx github.com/moby/buildkit (Go) Fixed in 0.12.5 Advisory →

Red Hat 1 advisory

  • RHSA-2024:2988 Released 2024-05-22 · Red Hat rating Moderate
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x::container-tools:rhel8 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:2988
Not affected: 4 products
  • OpenShift Serverless
  • OpenShift Service Mesh 2
  • Red Hat Ansible Automation Platform 1.2
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23650
  2. 2026-10-03 Alias added: GHSA-9p26-698r-w4hx

References

Patch 2

Advisory 2

Other 6

  • TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
  • TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
  • TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
  • TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
  • TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
  • TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
See all 57 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences