Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M
CVE-2026-61801github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files
Medium 5.5
In plain English
A medium-severity uncontrolled resource consumption in sys from moby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-moby-sys | no fix listed | DEBIAN-CVE-2026-61801 |
| Debian:13 | golang-github-moby-sys | no fix listed | DEBIAN-CVE-2026-61801 |
| Debian:14 | golang-github-moby-sys | 0.0~git20260904.79376e0-1 | DEBIAN-CVE-2026-61801 |
| Go | github.com/moby/sys/user | 0.4.1 | GHSA-mjcv-p78q-w5fw |
| Go | github.com/moby/sys/user | 0.4.1 | GO-2026-6686 |
| Ubuntu:22.04:LTS | golang-github-moby-sys | no fix listed | UBUNTU-CVE-2026-61801 |
| Ubuntu:24.04:LTS | golang-github-moby-sys | no fix listed | UBUNTU-CVE-2026-61801 |
| Ubuntu:26.04:LTS | golang-github-moby-sys | no fix listed | UBUNTU-CVE-2026-61801 |
| Ubuntu:26.10 | golang-github-moby-sys | no fix listed | UBUNTU-CVE-2026-61801 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw x_refsource_CONFIRM
- https://github.com/moby/sys/pull/221 x_refsource_MISC
- https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe x_refsource_MISC