VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/moby/buildkit: vulnerability history, versions and safety

github.com/moby/buildkit is a package in the Go ecosystem. Vulert records 17 vulnerabilities for it across 120 releases, from Mar 2023 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
17 vulnerabilities recorded C2 H3 M3 L1 U8
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
8 in the last 12 months

Most recent disclosure 25 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/moby/buildkit vulnerabilities

Vulert verdict on github.com/moby/buildkit v0.34.1 i

Updated on 23 Oct 2026

Action needed: v0.34.1 has 16 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 72/100
  • Security Unfixed issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.34.1 — affected i
  • Vulnerabilities on record 17 over 3 years · 8 in the last year i
  • Latest disclosure 25 Aug 2026 i
  • Highest CVSS 10.0 i
  • With no published fix 0 i
  • Stars 10,333 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/moby/buildkit, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.34.0-rc2.0.20261023101025-fc10d048454e 23 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261023081157-5855f9ad776a 23 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261023053040-1a046037113a 23 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261023053040-1a046037113a 23 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261022161710-1d3897ae8cce 22 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261022161710-1d3897ae8cce 22 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261022060957-98d9aa8f76ed 22 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261022060957-98d9aa8f76ed 22 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261021054326-3183b78af37f 21 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261021054326-3183b78af37f 21 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261020133258-647a85c3350d 20 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261020133258-647a85c3350d 20 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261020074302-51af51f96a2e 20 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261019214839-2755b2f1e28d 19 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261019214839-2755b2f1e28d 19 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261016132359-64aefaef4d7d 16 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261016132359-64aefaef4d7d 16 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261014033415-8e20b4110a54 14 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261014033415-8e20b4110a54 14 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261013181144-91a2a0930778 13 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261012180857-7b962650aaa9 12 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261012180857-7b962650aaa9 12 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261012122248-3cfa993c98d3 12 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261012101322-96452ebb8ec9 12 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261012071412-d4d5d668a5f4 12 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261012071412-d4d5d668a5f4 12 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261009181247-325ea68ea5b8 09 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261009181247-325ea68ea5b8 09 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261008193238-1e65adcd0976 08 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261008193238-1e65adcd0976 08 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261007191819-f5b59a1f2fb2 07 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0 07 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.1 07 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261007154959-656dabf81400 07 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2.0.20261007154959-656dabf81400 07 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc2 06 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261006193621-53bd1f3ea06b 06 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc1.0.20261006171613-c445f55059fc 06 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261006093453-9734cd037bcf 06 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc1.0.20261006093453-9734cd037bcf 06 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261005175738-19f31ff5bb57 05 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc1.0.20261005175738-19f31ff5bb57 05 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261003001641-106f55ce1f4a 03 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc1.0.20261003001641-106f55ce1f4a 03 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261001213222-82a1f40db962 01 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc1.0.20261001213222-82a1f40db962 01 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20261001125231-88064964ef21 01 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc1.0.20261001125231-88064964ef21 01 Oct 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.34.0-rc1 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260930200550-ece70d28c126 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260930162854-08f4630c67a4 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.2-0.20260930162854-08f4630c67a4 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.1 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260930113925-9cf07af671e3 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260930113925-9cf07af671e3 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.1-0.20260930101553-f07430665721 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260930013614-05795897e3c3 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260930001835-9fc65986c4d2 30 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260929174553-c2dc44a54ab4 29 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260929174553-c2dc44a54ab4 29 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260929005127-90b8639e6de8 29 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260929005127-90b8639e6de8 29 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260928090536-691458e7819f 28 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260928090536-691458e7819f 28 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260926092934-8abafbcdece1 26 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260926092934-8abafbcdece1 26 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260926004421-efcdd8579962 26 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260925222958-48176e654b0f 25 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260925130258-f6b5e081aa78 25 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260924224722-1681f53209a7 24 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260924224722-1681f53209a7 24 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260924005807-878c3a5ffb95 24 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260924005807-878c3a5ffb95 24 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260923135404-e1d0ff632742 23 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260923135404-e1d0ff632742 23 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260922175525-aa44e3a9861d 22 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260922175525-aa44e3a9861d 22 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260922140836-5427d61296f2 22 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260921074813-9215874dc233 21 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260921074813-9215874dc233 21 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260918230256-99bd9de47d29 18 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260918230256-99bd9de47d29 18 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260918171812-a6180cbebd01 18 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260918160733-2d1cf03c1197 18 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260918065635-ba2effb9f630 18 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260918065635-ba2effb9f630 18 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260917221521-05630d1411c3 17 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260917082218-92b62f07aeb9 17 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260917062359-9d350c077a61 17 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260917062359-9d350c077a61 17 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260916102434-16c4a6074bbc 16 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260914090850-9bc3354b43dd 14 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260914090850-9bc3354b43dd 14 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260914080020-4d8f7073da41 14 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260910225303-b7c2f61e845c 10 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260910225303-b7c2f61e845c 10 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260909062958-3ed6f95b290c 09 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260909062958-3ed6f95b290c 09 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260908084853-ab362caa3e80 08 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.0.0-20260906160352-29f5975892d6 06 Sep 2026 C2 H3 M2 L1 U8 Apache-2.0 Yes Details →
v0.33.0-rc1.0.20260906160352-29f5975892d6 06 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260906112443-405ed4beb77d 06 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260903183121-703866e5f2e4 03 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260903183121-703866e5f2e4 03 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260902070653-ca4838f8ddbd 02 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260902070653-ca4838f8ddbd 02 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260901220804-773764d8bdc8 01 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260901124751-dddd5621af04 01 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0 01 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc2 01 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260901113243-531c55f275de 01 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260901113243-531c55f275de 01 Sep 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260828215536-2a684cd90798 28 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260828215536-2a684cd90798 28 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260828200148-416897a72622 28 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260827232111-40f08e56eb56 27 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260827232111-40f08e56eb56 27 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1.0.20260827080248-c06e371da9f7 27 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.33.0-rc1 26 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →
v0.0.0-20260826145436-b09f8f1c0a2b 26 Aug 2026 C2 H3 M2 L1 U8 — Yes Details →

The newest 120 of 5,835 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 1
  • 2024 8
  • 2026 8

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 8 of the 17 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/moby/buildkit

The 5 most severe of 17 vulnerabilities recorded for this package

Search all 17 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-23652: BuildKit Vulnerable to Possible Host System Access 10.0 critical 0.12.5 31 Jan 2024
CVE-2024-23653: Buildkit's interactive containers API does not validate entitlements check 9.8 critical 0.12.5 31 Jan 2024
CVE-2024-23651: BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts 8.7 high 0.12.5 31 Jan 2024
CVE-2026-33747: BuildKit Malicious Frontend File Escape Vulnerability 8.4 high 0.28.1 26 Mar 2026
CVE-2026-33748: BuildKit Git URL Subdir Component Vulnerability in github.com/moby/buildkit 8.2 high 0.28.1 26 Mar 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/moby/buildkit

Is github.com/moby/buildkit safe to use?

Vulert records 17 vulnerabilities for github.com/moby/buildkit in Go: 2 critical, 3 high, 3 medium and 1 low, plus 8 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/moby/buildkit's Vulert package health score?

Vulert scores github.com/moby/buildkit 72/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/moby/buildkit affected?

Yes. v0.34.1, the version you would install today, has 16 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/moby/buildkit should I use?

v0.34.1 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/moby/buildkit have?

17 vulnerabilities are recorded for github.com/moby/buildkit in the Go ecosystem: 2 critical, 3 high, 3 medium and 1 low, plus 8 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/moby/buildkit vulnerabilities disclosed?

8 vulnerabilities were recorded for github.com/moby/buildkit in the last 12 months, and the oldest entry in this database dates to 07 Mar 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/moby/buildkit are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/moby/buildkit for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/moby/buildkit version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.