Technical impact
A malicious frontend can submit a malformed MergeOp that causes the BuildKit daemon to panic and terminate, interrupting all builds that are currently running. This leads to a disruption of the build service, effectively a denial‑of‑service condition. The weakness aligns with CWE‑129, involving signed integer misuse that triggers undefined behavior. Although Dockerfile builds are not directly affected, any build that relies on the compromised frontend will be halted, thereby impacting downstream services and deployments. The CVSS score of 6.9 indicates a medium severity risk, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog, but its exploitation requires an attacker to provide a custom frontend capable of sending a crafted LLB definition. The crash cannot be avoided by simply ignoring Dockerfile builds; it occurs whenever a frontend processes the malformed MergeOp, so a generic defense is required.
Affected Systems
The BuildKit daemon, part of the moby:BuildKit product, is vulnerable when it accepts external or third‑party frontends that can supply custom LLB definitions. No specific version range is provided in the data, but the references point to release v0.33.1 and the issue likely affects any BuildKit deployment that contains the same code path.
Risk and Exploitability
The CVSS score of 6.9 rates this flaw as medium severity; the lack of an EPSS score means its exploitation probability has not been quantified. The vulnerability is not listed in CISA KEV. Likely attack vectors involve an attacker with the ability to surface or register a malicious frontend—either remotely or locally—to submit a crafted MergeOp. Once the BuildKit daemon receives the malformed definition, it will panic and terminate, which disrupts all running builds and any services that depend on them.
