Back Linuxsecurity

Fedora 44 docker-buildkit High Denial of Service Risk CVE-2026

Linuxsecurity •LinuxSecurity Advisories • June 27, 2026

Update to release v0.31.0 Resolve CVE-2026-39829: rhbz#2489939, rhbz#2490056 Upstream new features and fixes

* Wed Jun 17 2026 Bradley G Smith - 0.31.0-1 - Update to release v0.31.0 - Resolve CVE-2026-39829: rhbz#2489939, rhbz#2490056 - Upstream new features and fixes

[ 1 ] Bug #2489939 - CVE-2026-39828 docker-buildkit: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions [fedora-all] [ 2 ] Bug #2490056 - CVE-2026-39829 docker-buildkit: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1e00728616' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Fedora Docker-Buildx and Buildkit Fedora has released updates addressing critical vulnerabilities in docker-buildx and docker-buildkit. CVE-2026-39828 allows unauthorized command execution via discarded SSH permissions, while CVE-2026-39829 enables denial of service through crafted public keys. Both vulnerabilities were published on May 22, 2026, and affect users of Fedora 43 and 44. The updates, released on June 18, 2026, resolve these issues and include upstream enhancements. Users are advised to upgrade to the latest version using the 'dnf' update program. The vulnerabilities pose significant risks to system integrity and availability, necessitating immediate action from administrators. 6 sources 73

Extracted Entities

Fedora 44 docker-buildkit High Denial of Service Risk CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)