CVE-2026-121522

The record

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

Affected packages

Related vulnerabilities

• CVE-2026-120955 The GridFS file download API in the MongoDB C Driver does not check the result of an… CWE-476
• CVE-2026-115297 NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to… CWE-476
• CVE-2026-120758 HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HL_unprotect()… CWE-476
• CVE-2026-43603 A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel… CWE-476
• CVE-2026-121402 FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows… CWE-476
• CVE-2026-121401 FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet… CWE-476
• CVE-2026-115403 In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket… CWE-476
• CVE-2026-114408 In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6… CWE-476