CVE-2026-56855: Docker Buildx Denial of Service Patched in Fedora 43 — Update to v0.37.2/v0.38.0 Now

Fedora has released an update for the docker-buildx package in Fedora 43 addressing CVE-2026-56855, a denial-of-service vulnerability in Docker Buildx — the CLI plugin that powers docker build on modern Docker installations and drives countless CI/CD build pipelines. The update ships Buildx v0.37.2 for the stable branch and v0.38.0 as the current feature release, resolving Red Hat Bugzilla entries rhbz#2544412, rhbz#2544198, and the CVE tracking bug rhbz#2530594.

If your organization builds container images on Fedora 43 workstations or build nodes — and especially if those nodes process untrusted build contexts, Dockerfiles, or remote Git sources — this update belongs at the top of your patch queue this week.

Why Defenders Should Care

Build infrastructure is a soft target that attackers increasingly value. A denial-of-service condition in the build toolchain has outsized blast radius compared to a DoS in a single application:

• CI/CD pipeline disruption. A crashed or hung builder stalls every downstream stage — image publishing, deployments, and in some shops, security scanning gates that only run after a successful build. Attackers who can repeatedly crash your builders effectively hold your release velocity hostage.
• Shared build node contention. Buildx is routinely run with elevated privileges (--privileged builds, BuildKit daemons with broad socket access). A DoS triggered by one tenant's build job can impact every other pipeline sharing that node.
• Supply-chain choke point. Modern software supply chains converge on the build step. Anything that destabilizes or monopolizes the builder — even 'just' a crash — creates windows where teams bypass controls under pressure to ship.

Treat build infrastructure with the same patch discipline you apply to internet-facing services. In 2026, it is internet-facing in practice: builders routinely pull remote contexts, external base images, and third-party Dockerfile sources.

Technical Analysis

Affected Products and Versions

Vulnerability Profile

CVE-2026-56855 is a denial-of-service condition in the Buildx build client. While detailed technical write-ups from the upstream maintainers are still propagating, the defensive picture is clear from the fix metadata:

• Attack surface: The Buildx CLI parses build inputs — Dockerfiles, build contexts, bake definitions (HCL/JSON), remote Git URLs, and provenance/attestation metadata. DoS flaws in this class of tooling typically manifest as resource exhaustion (memory/CPU), infinite loops, or panics triggered by malformed or adversarially crafted input.
• Exploitation requirements: An attacker would need the ability to influence a build input processed by a vulnerable Buildx instance. In practice this means: contributors to repositories built by your CI, anyone who can influence a Dockerfile or bake file your builders consume, or control over a remote build context your pipelines reference.
• Impact: Loss of availability of the build process or builder daemon. On shared CI runners this translates to pipeline-wide disruption.

Exploitation Status

As of this writing there is no confirmed in-the-wild exploitation of CVE-2026-56855 and it does not appear in the CISA Known Exploited Vulnerabilities catalog. However, the bar for exploiting input-parsing DoS bugs in build tooling is low — they require no memory-corruption sophistication, and proof-of-concept material for build-tool DoS issues historically appears quickly after disclosure. Fedora's decision to ship both a stable-branch backport (v0.37.2) and the feature release (v0.38.0) signals upstream treated this as a security priority, not a routine bug.

Do not wait for a public PoC. Patch now.

Detection & Response

The most valuable detection work here is identifying vulnerable Buildx installations and watching for build-process instability consistent with DoS triggering — repeated crashes, hung builds, and anomalous resource consumption by buildx/buildkitd processes.

Sigma Rules

These rules target Linux process-creation telemetry (auditd/Sysmon for Linux) and are tuned to fire on instability patterns and inventory signals, not routine builds.

---
title: Docker Buildx Process Crash or Abort Detected
id: 3f7a1c92-5b84-4e6d-9a21-7c4e8d2f1b05
status: experimental
description: Detects repeated termination or crash-looping of docker buildx/buildkit processes, consistent with a denial-of-service condition such as CVE-2026-56855 being triggered by malformed build input.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-docker-buildx-2026-60dcacbb4f
  - https://attack.mitre.org/techniques/T1499/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'buildx build'
      - 'buildx bake'
      - 'buildkitd'
  condition: selection
falsepositives:
  - Legitimate build activity — correlate with exit codes, crash dumps, and repetition rate before escalating
level: low
---
title: Buildx Build Initiated from Untrusted Remote Context
id: 8c2e4d17-9a3b-4f58-b6c2-1d7e5a903f46
status: experimental
description: Detects docker buildx builds pulling remote build contexts from external URLs. Remote contexts are the primary delivery vector for malformed input that could trigger CVE-2026-56855; unexpected remote builds warrant review.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-docker-buildx-2026-60dcacbb4f
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.supply_chain_compromise
  - attack.t1195
logsource:
  category: process_creation
  product: linux
detection:
  selection_buildx:
    CommandLine|contains: 'buildx build'
  selection_remote:
    CommandLine|contains:
      - 'https://'
      - 'http://'
      - 'git@'
      - 'github.com'
  condition: selection_buildx and selection_remote
falsepositives:
  - CI pipelines legitimately building from remote Git contexts — allowlist known repository URLs and pipeline identities
level: medium
---
title: Unpatched Buildx Version Execution Detected
id: b14d6f28-3e9c-4a71-8d05-2f6b9c417e38
status: experimental
description: Detects execution of docker buildx version checks, enabling correlation of running Buildx versions against the CVE-2026-56855 fixed releases (v0.37.2 / v0.38.0). Use as an inventory and patch-verification signal.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-docker-buildx-2026-60dcacbb4f
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'buildx version'
      - 'buildx --version'
  condition: selection
falsepositives:
  - Administrators and automation verifying plugin versions — expected activity, use for inventory enrichment only
level: informational

KQL — Microsoft Sentinel / Defender

For environments shipping Linux Syslog or auditd telemetry into Sentinel, this query identifies vulnerable Buildx versions still in use and build processes terminating abnormally — the two signals that matter for CVE-2026-56855.

// Hunt 1: Identify vulnerable Buildx versions across Linux build nodes
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("docker", "buildx")
| where SyslogMessage has "buildx version" or SyslogMessage has "Client: Docker Engine"
| extend BuildxHost = Computer
| summarize LastSeen = max(TimeGenerated), SampleMessage = any(SyslogMessage) by BuildxHost
| project BuildxHost, LastSeen, SampleMessage
| order by LastSeen desc;

// Hunt 2: Detect repeated docker buildx / buildkitd process failures (DoS pattern)
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("buildx", "buildkitd")
| where SyslogMessage has_any ("panic", "segmentation fault", "OOM", "killed", "core dumped", "exit status")
| summarize CrashCount = count(), DistinctMessages = dcount(SyslogMessage) by Computer, bin(TimeGenerated, 1h)
| where CrashCount >= 3
| order by CrashCount desc;

// Hunt 3 (Defender for Endpoint): buildx builds referencing remote contexts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has "buildx build"
| where ProcessCommandLine has_any ("https://", "http://", "git@")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact to sweep Linux build nodes for the installed Buildx plugin version and flag anything below the fixed releases — a fast, forensically sound way to size your exposure before patching.

-- Hunt: Enumerate docker-buildx installations and versions on Linux endpoints
LET plugin_paths = glob(globs=['/usr/libexec/docker/cli-plugins/docker-buildx',
                               '/usr/lib/docker/cli-plugins/docker-buildx',
                               '/usr/local/lib/docker/cli-plugins/docker-buildx',
                               '/root/.docker/cli-plugins/docker-buildx',
                               '/home/*/.docker/cli-plugins/docker-buildx'])
SELECT FullPath,
       Mtime,
       Size,
       read_file(filename=FullPath, length=0) AS Present
FROM plugin_paths

-- Hunt: Find buildx/buildkitd processes currently running and their command lines
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'buildx|buildkitd'
   OR Exe =~ 'docker-buildx'

Remediation and Verification Script (Bash)

Run this on Fedora 43 build nodes and developer workstations to verify the installed Buildx version and apply the fixed packages.

#!/usr/bin/env bash
# CVE-2026-56855 — docker-buildx DoS remediation/verification for Fedora 43
set -euo pipefail

# Step 1: Report current Buildx version (plugin + package)
echo "=== Installed docker-buildx plugin version ==="
docker buildx version 2>/dev/null || echo "buildx plugin not found in PATH"
echo "=== Installed RPM version ==="
rpm -q docker-buildx 2>/dev/null || echo "docker-buildx RPM not installed"

# Step 2: Apply the Fedora 43 security update (v0.37.2 / v0.38.0 or later)
echo "=== Applying update ==="
sudo dnf upgrade --refresh -y docker-buildx

# Step 3: Verify the patched version is now installed
echo "=== Post-update verification ==="
NEW_VER=$(docker buildx version 2>/dev/null | awk '{print $2}')
echo "Buildx version now: ${NEW_VER}"
case "${NEW_VER}" in
  v0.37.2|v0.38.*|v0.39.*) echo "PASS: Version is patched against CVE-2026-56855" ;;
  *) echo "WARN: Version may still be vulnerable — confirm against Fedora advisory" ;;
esac

# Step 4: Restart BuildKit builders to pick up the fix
docker buildx ls
echo "Consider recreating persistent builders: docker buildx rm --all-inactive"

# Step 5: Audit recent build logs for crash signatures (DoS trigger attempts)
echo "=== Scanning journal for buildx/buildkitd crashes (last 7 days) ==="
journalctl --since "7 days ago" 2>/dev/null | grep -iE "buildx|buildkitd" | grep -iE "panic|segfault|oom|core dumped" | tail -n 20 || echo "No crash signatures found"

Remediation

1. Patch immediately. On Fedora 43, run sudo dnf upgrade --refresh docker-buildx. The fixed releases are v0.37.2 (stable backport) and v0.38.0. Confirm with docker buildx version after updating.
2. Check non-Fedora installs too. Buildx is frequently installed manually as a CLI plugin (~/.docker/cli-plugins/docker-buildx) or bundled with Docker Desktop — dnf will not touch those. Inventory every path shown in the VQL hunt above and upgrade manual installs from the official Buildx releases page.
3. Restart or recreate BuildKit builders. Existing builder instances may hold the old binary in memory. Recreate inactive builders with docker buildx rm --all-inactive and restart shared BuildKit daemons.
4. Constrain remote build contexts. Until you are confident all builders are patched, restrict CI pipelines to building from known, pinned repository sources. Treat any docker buildx build <remote-url> invocation as untrusted input.
5. Isolate build workloads. Run builds on dedicated, least-privilege runners. Avoid --privileged builds where possible, and segment build nodes so a DoS on one pipeline cannot cascade across the fleet.
6. Monitor for instability. Deploy the crash-pattern detection above. Repeated buildx/buildkitd failures on an unpatched node are your leading indicator of attempted triggering.
7. Track the advisory. Reference: Fedora docker-buildx update (Fedora 43) and Red Hat Bugzilla rhbz#2530594 for the CVE record as additional technical detail is published.

The broader lesson: build tooling is supply-chain infrastructure. CVE-2026-56855 is a DoS, not RCE — but an attacker who can crash your builders on demand controls your ability to ship, including your ability to ship security fixes. Patch the pipeline with the same urgency you patch the perimeter.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub