{
  "cveId": "CVE-2026-93318",
  "url": "https://patchblox.com/security/cve/CVE-2026-93318",
  "summary": "CVE-2026-93318 is fixed in 4 products on 1 platform, first by ALAS2023-2026-3264, released November 7, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Cache poisoning via unvalidated image layer DiffIDs",
  "description": "A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents.",
  "published": "2026-10-09T01:41:29Z",
  "severity": "Important",
  "cwe": "Improper Validation of Integrity Check Value",
  "epss": 0.00167,
  "epssPercentile": 0.0604,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-93318",
  "fixes": [
    {
      "platform": "linux",
      "product": "docker",
      "release": "amzn 2023",
      "fixedVersion": "25.0.18-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-3391",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3391",
      "released": "2026-11-10T03:56:13Z"
    },
    {
      "platform": "linux",
      "product": "docker-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "25.0.18-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-3391",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3391",
      "released": "2026-11-10T03:56:13Z"
    },
    {
      "platform": "linux",
      "product": "docker-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "25.0.18-1.amzn2023.0.3",
      "fix": "ALAS2023-2026-3391",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3391",
      "released": "2026-11-10T03:56:13Z"
    },
    {
      "platform": "linux",
      "product": "runfinch-finch",
      "release": "amzn 2023",
      "fixedVersion": "1.19.0-1.amzn2023.0.2",
      "fix": "ALAS2023-2026-3264",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3264",
      "released": "2026-11-07T01:06:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T07:45:43Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}