CVE-2026-61712
CVE-2026-61712: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.5
Medium [CVE-2026-61712] Denial of Service via unbounded group parsing
CVE-2026-61712Source published Source updated
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1. A flaw was found in BuildKit. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them without an upper bound, leading to excessive memory consumption. This can cause the buildkitd process to…
- Affected products in this advisory
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Compliance Operator
- Confidential Compute Attestation
- Kernel Module Management Operator for Red Hat Openshift
31 more entries in the full advisory.
- Source-reported affected versions
- < 0.31.1
- Source-reported fixed versions
- 0.31.1
- Mitigation guidance
- To mitigate this issue, avoid building images from untrusted or unverified sources. If processing untrusted build definitions is necessary, consider implementing strict resource limits on build processes to prevent excessive memory consumption. This operational control helps contain the impact of potential memory exhaustion.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.