CVE-2026-61801

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...

CVE-2026-61801

The "github.com/moby/sys/user" package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing "/etc/passwd"- or "/etc/group"-style files, allowing an attacker who can supply a...

github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files

A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a...