CVE-2026-61801 Details
Description
The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
A denial-of-service vulnerability has been identified in the Moby sys user package, specifically in versions prior to 0.4.1. The issue arises from insufficient limits on entries when parsing Unix-style user and group database files. This vulnerability allows an attacker to supply a specially crafted file, leading to excessive memory consumption and potentially causing the affected process to terminate due to out-of-memory conditions. The problem is particularly relevant for applications using this package to parse untrusted '/etc/passwd' or '/etc/group' files.
Users are advised to upgrade to version 0.4.1 or later. For applications that must process untrusted user or group database files, it is recommended to validate and limit the input before parsing. As an additional step, the updated functions can be used to ensure that the parsing adheres to the new safety measures.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe | [email protected] | Source CodeVendor |
| https://github.com/moby/sys/pull/221 | [email protected] | Source CodeVendor |
| https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| github.com/moby/sys/user | <= v0.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |