Live › vulnerability › CVE-2026-121522
BuildKit versions v0.26.0 through v0.34.1 panic and crash when a specific build definition resolves metadata for the same Git source reference twice. The crash interrupts builds handled by that daemon.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Teams that run a BuildKit daemon, including self-hosted build servers and CI runners, and that build from Git sources. Hosts on versions outside v0.26.0 through v0.34.1 are not affected. Builds that do not resolve Git sources do not reach the flawed path, as the description ties the crash to a Git source reference.
No product ranges from the sources yet.
buildkitd --version or docker buildx version on the build host to see the BuildKit version.v0.34.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-121522")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.