buildkit

v0.31.1 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Build & Package

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

builder buildkit cloud-native containers docker go

+1 more

oci-image

Affected surfaces

rce_ssrf breaking_upgrade

Summary

AI summary

Two low‑severity security fixes address custom frontend bypass and runtime DoS via unbounded group parsing.

Full changelog

buildkit 0.31.1

Welcome to the v0.31.1 release of buildkit!

This is a security patch release with two low severity security fixes.

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

Tõnis Tiigi

Notable Changes

Custom frontend could bypass Seccomp/AppArmor restrictions https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6
Possible runtime DoS via unbounded group parsing https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86

Dependency Changes

This release has no dependency changes

Previous release can be found at v0.31.0

Security Fixes

GHSA-7236-3392-c5c6 — Custom frontend could bypass Seccomp/AppArmor restrictions
GHSA-72x6-4j93-7w86 — Possible runtime DoS via unbounded group parsing

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track buildkit

Get notified when new releases ship.

About buildkit

concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit

All releases →