CVE-2026-93323

Executive Summary

CVE-2026-93323 is a uncontrolled resource consumption flaw (CWE-789) in the Dockerfile frontend used by BuildKit/buildkitd, where Dockerfile and .dockerignore files from a build context are loaded into memory without a size limit. Any build whose context contains an oversized Dockerfile or .dockerignore file can cause buildkitd to allocate memory proportional to that file, exhausting host/daemon memory and terminating the daemon. Multiple concurrent or tenant-shared builds on the same BuildKit instance are impacted, producing a denial-of-service condition for all builds hosted by that daemon.

Technical Analysis

The vulnerability resides in the Dockerfile frontend of BuildKit. When a build is initiated, the frontend ingests two control files from the supplied build context: Dockerfile and .dockerignore. Per the NVD description, both files were read into memory without enforcing an upper size bound. Because the frontend processes these files as part of normal build parsing, the memory footprint scales linearly with file size — an attacker (or an unlucky developer) who supplies a multi-gigabyte Dockerfile or .dockerignore forces buildkitd to allocate memory proportional to that file.

The root cause maps to CWE-789 (Memory Allocation with Excessive Size Value): the daemon accepts externally supplied input and allocates a buffer sized directly from that input without a ceiling. The nature of the attack surface is significant because build contexts are frequently supplied remotely — via docker build against a remote builder, via BuildKit's gRPC API, or via CI/CD systems that accept build requests from less-trusted contributors (pull requests, shared build queues). In multi-tenant or shared CI environments, one build's oversized control file consumes memory on a daemon shared by all tenants.

The impact is not memory corruption or code execution; it is a straightforward out-of-memory (OOM) condition. When the daemon allocates aggressively and the OS reclaims/kills the process, buildkitd terminates. Because other in-flight builds route through the same daemon, they are interrupted and fail. Recovery requires the daemon to be restarted, creating a denial-of-service window.

The vendor's described fix places a hard cap of 16 MiB on the size of these control files, rejecting anything above that threshold before it can be loaded into memory. This bounds worst-case allocation to a fixed, small value.

Exploitation Scenarios

Note: No public PoC is available. The attack chain below is described strictly at the vulnerability-class level, using only the file and component names present in the NVD description (Dockerfile, .dockerignore, buildkitd).

1. Reconnaissance / target identification. The adversary identifies a build service backed by BuildKit/buildkitd that accepts remotely supplied build contexts. This includes shared CI runners, remote builders exposed over the BuildKit gRPC API, or any pipeline where untrusted contributors can submit a build. Public exposure of the daemon API (e.g., builder endpoints reachable from an untrusted network) broadens the target set.

2. Triggering the flaw class. The adversary prepares a build context containing an oversized Dockerfile or .dockerignore file (in the multi-hundred-megabyte to multi-gigabyte range). The build is submitted normally. Because the frontend loads these control files into memory without a size limit, buildkitd begins allocating memory proportional to the file's size. No malformed syntax or exploit primitive is required — the mere size of the file triggers the condition.

3. Execution / payload mechanism. At the vulnerability-class level, no code execution payload is required. The "payload" is the oversized control file itself. The adversary simply needs the build request (and the accompanying context) to reach the frontend such that it opens the Dockerfile or .dockerignore file.

4. Post-exploitation impact. Memory consumption rises until the host reclaims memory and the daemon is terminated. All other builds on the same buildkitd instance are interrupted, and the service remains unavailable until the daemon is restarted. If the platform allows repeated submissions, the adversary can re-trigger the condition to sustain the denial-of-service, effectively creating a persistent resource-exhaustion condition for the shared build service.

Impact Assessment

The primary impact is availability (denial of service). There is no confidentiality or integrity impact described: the flaw does not disclose data or enable code execution, so the CVSS vector isolates the effect to A:H (High availability impact) with C:N/I:N (no confidentiality or integrity impact). Attack complexity is low (AC:L) because the technique requires no special conditions beyond submitting a large file — no race, no privileged memory layout, no user interaction (UI:N). Privileges required are likely low (PR:L): a party able to submit builds to the target daemon — a contributor, a CI job, or an authenticated tenant — is sufficient. Scope is unchanged (S:U), since the daemon's memory exhaustion does not cross a security boundary into an unrelated component beyond the shared-host effect.

The blast radius is the entire BuildKit instance. Because buildkitd multiplexes builds for many users/tenants, a single malicious or accidental oversized control file degrades or halts builds for every consumer of that daemon. In CI/CD environments, this translates to blocked merges, failed release pipelines, and delayed deployments. In environments where a node hosts multiple independent daemons, only the affected daemon's workload is impacted. Recovery cost is operational: restart of buildkitd and re-run of interrupted pipelines.

Detection Guidance

Sigma Rule

title: Oversized Dockerfile or .dockerignore in Build Context Leading to buildkitd OOM
id: 3c9a7f21-5e6d-4b8a-9c1d-2f7e4a0b8d33
status: experimental
description: Detects submission or presence of abnormally large Dockerfile or .dockerignore build control files, consistent with CVE-2026-93323 memory exhaustion.
logsource:
  product: linux
  service: auditd
detection:
  selection_write:
    type: 'PATH'
    name|endswith:
      - '/Dockerfile'
      - '/.dockerignore'
    key: 'build-context'
  selection_size:
    size|gte: 16777216
  condition: selection_write and selection_size
falsepositives:
  - Legitimately large generated Dockerfiles in monorepo projects
  - Vendored build contexts with embedded content
level: medium
tags:
  - attack.t1499
  - cve.2026.93323

YARA Rule

rule CVE_2026_93323_Oversized_Build_Control_File
{
    meta:
        author = "Valters IT"
        description = "Detects oversized Dockerfile/.dockerignore control files associated with CVE-2026-93323 (BuildKit memory exhaustion)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93323"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s_from = "FROM"
        $s_dockignore = ".dockerignore"

    condition:
        filesize > 16MB and
        (uint32(0) == 0x4d524f46 or $s_from or $s_dockignore)
}

Suricata IDS Rule

alert tcp any any -> any 2375 (msg:"CVE-2026-93323 BuildKit oversized build control file transfer attempt"; flow:established,to_server; content:"Dockerfile"; nocase; content:".dockerignore"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-dos; reference:cve,2026-93323; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93323; sid:10093323; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("buildkitd", "buildctl") and
  process.command_line : ("*docker build*" or "*buildctl*")

Note: This detects new build invocations for correlation with subsequent OOM/daemon-termination events monitored via system.memory or kernel OOM-killer logs.

Splunk SPL Query

index=main (sourcetype=syslog OR sourcetype=auditd)
  ("buildkitd" OR "Dockerfile" OR ".dockerignore" OR "oom" OR "Out of memory")
| stats count by host, process, message
| where count > 0

Wazuh OSSEC Rule

<group name="buildkit,cve-2026-93323,">
  <rule id="100933" level="10">
    <decoded_as>syslog</decoded_as>
    <match>buildkitd</match>
    <match>out of memory|OOM|killed|terminated</match>
    <description>CVE-2026-93323: buildkitd terminated due to memory exhaustion during build</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Enforce an independent size limit on build control files at the pipeline or ingress layer before they reach buildkitd — cap Dockerfile and .dockerignore at or below 16 MiB using CI validation, .gitattributes, pre-build hooks, or a context-sanitization step. Where BuildKit accepts remote/API-submitted contexts, restrict the daemon API to trusted networks and require authentication. Apply cgroup/rlimit memory ceilings to buildkitd processes so an OOM cannot take down the whole node. Isolate shared builders from untrusted contributors.

2. Patch/upgrade steps: No patch reference is available from tracked sources (Patch Confidence 0/4). Monitor the Moby/BuildKit project advisory channels, Docker release notes, and the NVD entry for CVE-2026-93323. When a fixed buildkitd/Docker Engine release is published, upgrade buildkitd to the patched version, which the vendor describes as rejecting oversized Dockerfile and .dockerignore files above 16 MiB.

3. Long-term hardening: Treat build contexts as untrusted input — validate file sizes, counts, and types before build submission. Segment builders by trust level so one tenant's build cannot exhaust memory shared by all. Deploy per-builder memory quotas and alerting on memory pressure. Enable OOM-killer logging and correlate it with build submissions to detect malicious or accidental triggering early.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-93323
• CWE-789 — Memory Allocation with Excessive Size Value: https://cwe.mitre.org/data/definitions/789.html
• Moby/BuildKit project: https://github.com/moby/buildkit
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA KEV catalog: Not listed as of this report (no evidence of exploitation in the wild).

No public PoC, exploit code, Nuclei template, or threat-actor campaign has been identified for this CVE at the time of writing. EPSS has not yet assigned a score by FIRST.org.