github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

A denial-of-service DoS vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process...

CVE-2026-61801: Uncontrolled Resource Consumption

The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially...

PT-2026-108050

Name of the Vulnerable Software and Affected Versions github.com/moby/sys/user versions prior to 0.4.1 Description The github.com/moby/sys/user package, which provides Go utilities for parsing and looking up entries in Unix-style user and group database files, does not sufficiently limit entries...