Improper Validation of Integrity Check Value Affecting github.com/moby/buildkit/source/containerblob package, versions <0.33.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMMOBYBUILDKITSOURCECONTAINERBLOB-20826477
- published11 Oct 2026
- disclosed5 Oct 2026
- credithewei-gikaku, Yanhaoxi
Introduced: 5 Oct 2026
NewCVE-2026-93317 Â (opens in a new tab)How to fix?
Upgrade github.com/moby/buildkit/source/containerblob to version 0.33.1 or higher.
Overview
Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the Snapshot process in source/containerblob/pull.go. An authenticated client with raw LLB access can upload or reference registry or OCI layout blob data that does not match the claimed digest, causing the blob to be cached under that digest. Later builds that reuse the cache can receive the wrong snapshot contents, breaking build-input integrity and allowing a malicious build input to poison shared cached layers.
Workarounds
- Use the low-level LLB API only for trusted clients; do not expose raw LLB access on a shared
buildkitd, which prevents an authenticated client from injecting blob contents directly into the shared container blob cache. - Avoid direct registry blob access through the low-level LLB
source/containerblobpath; this blocks the attack vector that can cache mismatched blob data under a claimed digest.