CVE-2026-121522— Possible panic from Git source resolver
Quick assessment
Affected
moby BuildKit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 BuildKit 版本 v0.26.0 至 v0.34.1 中，若构建定义对同一 Git 源引用两次解析元数据，可能导致 BuildKit 守护进程发生 panic 并崩溃，从而中断该守护进程所处理的所有构建任务。此问题已在 v0.34.2 版本中修复。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-121522
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Possible panic from Git source resolver
Source: CVE Program / CVE List V5
Vulnerability Description
In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-121522
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-121522
请登录查看更多情报信息。
Other References for CVE-2026-121522 (1)
IV. Related Vulnerabilities
Same product: BuildKit
-
CVE-2026-121520
Malicious client could set xattr value outside of BuildKit s -
CVE-2026-93321
Malformed LLB file operation can crash buildkitd -
CVE-2026-93315
BuildKit proxy CA cleanup can be disrupted by build steps -
CVE-2026-93326
Crafted Git build source can bypass certain policy validatio -
CVE-2026-93323
Oversized Dockerfile or .dockerignore can exhaust buildkitd
Same vendor: moby
-
CVE-2026-121520
Malicious client could set xattr value outside of BuildKit s -
CVE-2026-61801
github.com/moby/sys/user has a possible DoS via unbounded pa -
CVE-2026-93321
Malformed LLB file operation can crash buildkitd -
CVE-2026-93315
BuildKit proxy CA cleanup can be disrupted by build steps -
CVE-2026-93326
Crafted Git build source can bypass certain policy validatio
Same weakness: CWE-476
-
CVE-2026-120955
MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download -
CVE-2026-115297
NULL Pointer Dereference in Packetbeat Leading to Denial of -
CVE-2026-120758
NULL Pointer Dereference in H5HL_unprotect via Corrupted Fil -
CVE-2026-43603
Linux GPU 驱动空指针解引用漏洞致拒绝服务 -
CVE-2026-121402
FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX