Technical impact
The Dockerfile frontend of BuildKit loads the Dockerfile and .dockerignore files from a build context into memory without imposing a size limit. Supplying a build context that contains an oversized Dockerfile or .dockerignore can cause buildkitd to allocate memory proportional to the file size, potentially exhausting the daemon’s memory and causing it to terminate. This results in a denial‑of‑service to any other builds running on the same instance. The weakness is a classic unbounded memory allocation flaw (CWE-789).
Affected Systems
Affected systems are instances of the moby BuildKit component. The advisory does not specify exact vulnerable versions, but the fix that rejects files larger than 16 MiB was introduced in the 0.33.1 release, so versions earlier than that are potentially vulnerable.
Risk and Exploitability
The CVSS score of 6.8 reflects a medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local attacker able to submit a build to the daemon. By providing a maliciously large Dockerfile or .dockerignore, the attacker can trigger a memory exhaustion that will terminate the daemon and disrupt all other builds. Given the lack of remote exploitation details, the risk is primarily localized to environments where untrusted build contexts are permitted.
