BuildKit performed unbounded parsing of the /etc/passwd and /etc/group files when resolving user and group identifiers. The lack of an upper bound allowed an attacker to supply oversized files, causing memory exhaustion and an out‑of‑memory termination of the buildkitd process. The effect is a denial of service that stops any builds in progress and may bring down continuous‑integration pipelines. This weakness is an instance of uncontrolled resource consumption, identified as CWE‑770.

The vulnerability affects the BuildKit component of the Moby project. All installations running BuildKit prior to version 0.31.1 are susceptible. The issue resides in the executor/oci/user.go and solver/llbsolver/ops/user_linux.go modules of those affected releases.

The official CVSS score of 2.3 indicates a low severity for confidentiality, integrity, and availability, yet the attack results in a service interruption. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred from the description: an attacker who can influence the contents of a base image or build context must craft oversized /etc/passwd or /etc/group files. Because that requires a curated build environment, exploitation likelihood in the wild is low, but the impact on build availability can be significant for affected servers.