Vulnerability · Published Oct 5, 2026 · Assigned by Docker
CVE-2026-93323Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
Medium 6.8
In plain English
A medium-severity security flaw in BuildKit from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).
Official description
The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build context into memory without a size limit. A build context containing an oversized file could make buildkitd allocate memory proportional to that file, potentially exhausting memory and terminating the daemon, which interrupts other builds on the same instance. Fixed by rejecting such files above 16 MiB.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:26.04:LTS | docker.io | no fix listed | UBUNTU-CVE-2026-93323 |
| Ubuntu:26.10 | docker.io | no fix listed | UBUNTU-CVE-2026-93323 |
| Ubuntu:26.04:LTS | docker.io-app | no fix listed | UBUNTU-CVE-2026-93323 |
| Ubuntu:26.10 | docker.io-app | no fix listed | UBUNTU-CVE-2026-93323 |
Affected products (as reported)
Weakness: CWE-789 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N