EUVD-2026-95094

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-61801

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

CVE-2026-61801 github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

GHSA-MJCV-P78Q-W5FW github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

CVE-2026-61801: Uncontrolled Resource Consumption

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: arm64: The issue was fixed in the concurrently setting of insnemulation sysctls. The emulationprochandler function changes table-data for procdointvecminmax. However, it may cause an OOPs error if called concurrently with itself:...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build ID returned by HYPERVISORxenversionXENVERbuildid is neither terminated with NUL nor a string. The first cause a buffer overflow because the sprintf function in buildidshow...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construction in sysrtas. Smatch warns: arch/powerpc/kernel/rtas.c:1932 dosysrtas warning: potential Spectre issue with ‘args args’ r local limit The ‘nargs’ and ‘nret’ locals originate from...

Release Information for Veeam KubeVirt Proxy

Purpose This article documents releases of the Veeam KubeVirt Proxy KVP utilized by the Veeam Plug-In for KubeVirt. Note: Veeam Plug-In for KubeVirt is also know as Veeam Plug-In for Red Hat OpenShift Virtualization. Release Information 1.0.1 2026-10-02 Security Updated the following packages to...

Rocky Linux 8.6 [CIQ] Security Update: perl-Sys-Virt / perl-Sys-Virt-debuginfo / perl-Sys-Virt-debugsource Multiple Vulnerabilities (ciqsa-2026_0134)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260134 advisory. This advisory aggregates security fixes for the perl-Sys-Virt SRPM in CIQ LTS 8.6. It addresses 3 CVEs: CVE-2024-3446, CVE-2024-7383, CVE-2024-7409...

Rocky Linux 8.6 [CIQ] Security Update: perl-Sys-Virt / perl-Sys-Virt-debuginfo / perl-Sys-Virt-debugsource Multiple Vulnerabilities (ciqsa-2026_0838)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260838 advisory. This advisory aggregates security fixes for the perl-Sys-Virt SRPM in CIQ LTS 8.6. It addresses 6 CVEs: CVE-2021-3507, CVE-2022-0897, CVE-2022-2211,...

OceanBase 3.2.4 < 3.2.4.8 / 4.2.1 < 4.2.1.10 / 4.2 < 4.2.5 / 4.3.3 < 4.3.3.2 Privilege Escalation (OBVD-2025-0205)

The version of OceanBase installed on the remote host is 3.2.4.x prior to 3.2.4.8, 4.2.1.x prior to 4.2.1.10, 4.2.x prior to 4.2.5, or 4.3.3.x prior to 4.3.3.2. It is, therefore, affected by a privilege escalation vulnerability as referenced in the OBVD-2025-0205 advisory. - In OceanBase's Oracle...

CVE-2026-97063

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and...

CVE-2026-97060

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

CVE-2026-97063 X-SpringBoot through 6.0 Authentication Bypass via Login Code

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and...