CVE-2026-121522: Possible panic from Git source resolver

Published Nov 3, 2026

Updated

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade BuildKit to a version that resolves this vulnerability.
Fixed in v0.34.2

Event History

Nov 3, 2026

CVE Published

via MITRE·10:09 PM

Data Sourced

via MITRE·10:09 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which BuildKit deployments are affected?

BuildKit versions v0.26.0 through v0.34.1 are affected. The issue is fixed in v0.34.2.

What is required to trigger the crash?

A build definition must resolve metadata for the same Git source reference twice. Successful triggering causes the BuildKit daemon to panic and crash, interrupting builds it handles.

What can be done if an immediate upgrade is not possible?

Avoid build definitions that resolve metadata for the same Git source reference twice until BuildKit can be updated to v0.34.2.

CVE-2026-121522: Possible panic from Git source resolver

Remediation

Event History

Frequently Asked Questions

Which BuildKit deployments are affected?

What is required to trigger the crash?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which BuildKit deployments are affected?

What is required to trigger the crash?

What can be done if an immediate upgrade is not possible?