Medium severity · published Oct 5, 2026
CVE-2026-93323
Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
6.8
CVSS
0.1%
EPSS
No
On KEV
Description
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
BuildKit · moby
through 0.33.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93323
vendor-advisory
https://github.com/moby/buildkit/security/advisories/GHSA-mgqf-486f-49vp
patch
https://github.com/moby/buildkit/releases/tag/v0.33.1
More from BuildKit
9.8
CVE-2026-33747
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
7.5
CVE-2026-93318
Cache poisoning via unvalidated image layer DiffIDs
7.5
CVE-2026-15793
Git source checkout from a bundle file could lead to command injection
7.5
CVE-2026-15792
Possible panic when incorrect parameters sent from frontend
7.5
CVE-2026-15791
LLB file operation can be tricked to remove /tmp directory contents