{"id":"CVE-2026-61801","aliases":["AZL-107042","AZL-107072","AZL-107099","AZL-107111","AZL-107243","AZL-107261","AZL-107303","AZL-107336","AZL-107360","AZL-107550","AZL-107571","AZL-107648","AZL-107664","AZL-107691","AZL-107745","AZL-107862","AZL-107883","AZL-107916","BELL-CVE-2026-61801","DEBIAN-CVE-2026-61801","EUVD-2026-95094","GHSA-mjcv-p78q-w5fw","GO-2026-6686","RHSA-2026:76430","RHSA-2026:76448","RHSA-2026:76677","SUSE-SU-2026:24374-1","UBUNTU-CVE-2026-61801","openSUSE-SU-2026:12152-1","openSUSE-SU-2026:12235-1","openSUSE-SU-2026:12260-1"],"status":"published","title":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00117,"percentile":0.01656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-08-03T22:26:40.86901Z","modified":"2026-11-09T12:49:55Z","fixes":[{"ecosystem":"Go","package":"github.com/moby/sys/user","fixed_in":["0.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"containerd2","fixed_in":["2.3.7-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"containerized-data-importer","fixed_in":["1.62.0-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"docker-compose","fixed_in":["2.27.0-16"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["4.1.0.kata1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers-cc","fixed_in":["3.15.0.aks0-23"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.30.10-32"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubevirt","fixed_in":["1.8.4-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"moby-engine","fixed_in":["25.0.18-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"runc","fixed_in":["1.4.3-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"skopeo","fixed_in":["1.14.4-15"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-35"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-moby-sys","fixed_in":["0.0~git20260904.79376e0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/moby/sys/user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.0"},{"fixed":"0.4.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.43.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.30.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-preview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.27.0~preview2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerd2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.62.0-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-buildx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.0-17"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0.7-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"docker-compose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27.0-16"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0.kata1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0.aks0-23"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.10-32"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libcontainers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240213-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"moby-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.18-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.4-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-35"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-moby-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20220606.416188a-1","0.0~git20231105.a4e0878-1","0.0~git20240807.5447519-1","0.0~git20240807.5447519-2","0.0~git20241107.638aa7c-1","0.0~git20241107.638aa7c-2","0.0~git20250819.9dc3a90-1","0.0~git20260904.79376e0-1","0.0~git20260904.79376e0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-moby-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20241107.638aa7c-2","0.0~git20250819.9dc3a90-1","0.0~git20260904.79376e0-1","0.0~git20260904.79376e0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-moby-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0~git20260904.79376e0-1"}]}],"versions":["0.0~git20241107.638aa7c-2","0.0~git20250819.9dc3a90-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/moby/sys/user","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/moby/sys/user","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.3-0.1.hum1"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.7-0.1.hum1"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.12-0.4.hum1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20261015.00-159998.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-moby-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20220606.416188a-1","0.0~git20231105.a4e0878-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-moby-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20250819.9dc3a90-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-moby-sys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20241107.638aa7c-2","0.0~git20250819.9dc3a90-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"google-osconfig-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20261015.00-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerized-data-importer1.65","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0-4.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"buildpacks-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.40.10-1.1"}]}],"bundled":5}],"products":[{"vendor":"moby","product":"sys"}],"references":[{"url":"https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw","tags":["x_refsource_CONFIRM","advisory","web","article","report"]},{"url":"https://github.com/moby/sys/pull/221","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe","tags":["x_refsource_MISC","fix","web","article","report"]},{"url":"https://github.com/advisories/GHSA-mjcv-p78q-w5fw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-61801","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61801.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-61801","tags":["advisory"]},{"url":"https://github.com/moby/sys","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76430","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13720","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-13719","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-81841","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-76154","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56851","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-61801","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24786","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-101899","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97394","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76430.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24786","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24786","tags":["advisory"]},{"url":"https://go.dev/cl/569356","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2611","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543885","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13719","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-13719","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13720","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13720","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-13720","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56851","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","tags":["advisory"]},{"url":"https://go.dev/cl/793360","tags":["article"]},{"url":"https://go.dev/issue/80112","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6629","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548048","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61801","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528028","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-76154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76154","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81841","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-81841","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553575","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97394","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.143.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550659","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101899","tags":["advisory"]},{"url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","tags":["article"]},{"url":"https://github.com/axios/axios/pull/11141","tags":["article"]},{"url":"https://github.com/axios/axios/releases/tag/v1.20.0","tags":["article"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76448","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76448.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76677","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-95502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109855","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100347","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100348","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100349","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100350","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-100351","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76677.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95502","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-95502","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100347","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100347","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.145.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100348","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100348","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100349","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.146.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553584","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100350","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553587","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100351","tags":["advisory"]},{"url":"https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/releases/tag/v0.147.0","tags":["article"]},{"url":"https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2553103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109855","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624374-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1284870","tags":["report"]},{"url":"https://bugzilla.suse.com/1285135","tags":["report"]},{"url":"https://bugzilla.suse.com/1285283","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95838","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-61801","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78662","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-61801","title":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T16:22:25.558Z","modified":"2026-10-08T17:27:37.645Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:53.786088Z"}],"euvd":[{"id":"EUVD-2026-95094","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T16:22:25Z","modified":"2026-10-08T17:27:37Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:28.108203Z"}],"ghsa":[{"id":"GHSA-mjcv-p78q-w5fw","title":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","description":"A denial-of-service (DoS) vulnerability exists in `github.com/moby/sys/user` before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious `/etc/passwd` or `/etc/group`-style file may cause excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions.\n\nThis issue is related to containerd [CVE-2026-47262] / [GHSA-jpcc-p29g-p8mq](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq), which describes one practical exploitation path through processing untrusted container image content. Applications using `github.com/moby/sys/user` to parse untrusted user or group database files may be similarly affected.\n\n### Impact\n\n`github.com/moby/sys/user` versions before v0.4.1 do not place sufficient limits on entries while parsing user and group database files. A specially crafted file may cause excessive memory consumption, potentially leading to process termination due to Out Of Memory (OOM) conditions.\n\nApplications that use `github.com/moby/sys/user` to parse user-supplied or otherwise untrusted `/etc/passwd` or `/etc/group` files may be affected. The severity depends on whether an attacker can influence the contents of files being parsed.\n\n### Patches\n\nThis issue is fixed in `github.com/moby/sys/user` v0.4.1. Users should upgrade to v0.4.1 or later.\n\n### Workarounds\n\nAvoid parsing attacker-controlled `/etc/passwd` or `/etc/group`-style files with affected versions of `github.com/moby/sys/user`.\n\nApplications that must process untrusted user or group database files should validate and limit accepted input before parsing. Upgrading to v0.4.1 or later is the recommended remediation.\n\n### References\n\n* containerd CVE-2026-47262 / GHSA-jpcc-p29g-p8mq: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq\n* Fix in `github.com/moby/sys/user`: https://github.com/moby/sys/user/commit/210d32ba2bcb4544ee968c7f31249fe59796e60b","status":"published","published":"2026-10-08T16:08:33Z","modified":"2026-10-08T16:08:35Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:29.107536Z"}],"nvd":[{"id":"CVE-2026-61801","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17.433Z","modified":"2026-10-08T21:35:53.89Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"BELL-CVE-2026-61801","title":"CVE-2026-61801 does not affect BellSoft software","status":"withdrawn","published":"2026-08-03T22:26:40.86901Z","modified":"2026-10-10T07:15:05.754243461Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-61801","title":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T16:22:25.558Z","modified":"2026-10-28T02:30:26.113622223Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:12.933503Z"},{"id":"DEBIAN-CVE-2026-61801","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17.433Z","modified":"2026-10-10T11:00:10.238652101Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-mjcv-p78q-w5fw","title":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","description":"A denial-of-service (DoS) vulnerability exists in `github.com/moby/sys/user` before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious `/etc/passwd` or `/etc/group`-style file may cause excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions.\n\nThis issue is related to containerd [CVE-2026-47262] / [GHSA-jpcc-p29g-p8mq](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq), which describes one practical exploitation path through processing untrusted container image content. Applications using `github.com/moby/sys/user` to parse untrusted user or group database files may be similarly affected.\n\n### Impact\n\n`github.com/moby/sys/user` versions before v0.4.1 do not place sufficient limits on entries while parsing user and group database files. A specially crafted file may cause excessive memory consumption, potentially leading to process termination due to Out Of Memory (OOM) conditions.\n\nApplications that use `github.com/moby/sys/user` to parse user-supplied or otherwise untrusted `/etc/passwd` or `/etc/group` files may be affected. The severity depends on whether an attacker can influence the contents of files being parsed.\n\n### Patches\n\nThis issue is fixed in `github.com/moby/sys/user` v0.4.1. Users should upgrade to v0.4.1 or later.\n\n### Workarounds\n\nAvoid parsing attacker-controlled `/etc/passwd` or `/etc/group`-style files with affected versions of `github.com/moby/sys/user`.\n\nApplications that must process untrusted user or group database files should validate and limit accepted input before parsing. Upgrading to v0.4.1 or later is the recommended remediation.\n\n### References\n\n* containerd CVE-2026-47262 / GHSA-jpcc-p29g-p8mq: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq\n* Fix in `github.com/moby/sys/user`: https://github.com/moby/sys/user/commit/210d32ba2bcb4544ee968c7f31249fe59796e60b","status":"published","published":"2026-10-08T16:08:33Z","modified":"2026-10-19T21:40:47.349593935Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"RHSA-2026:76430","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-06T10:19:13Z","modified":"2026-10-20T10:43:33.721268511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76448","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-06T10:19:14Z","modified":"2026-10-20T10:43:36.573107849Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:76677","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-10T10:21:53Z","modified":"2026-10-20T10:43:34.285261674Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-61801","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:00Z","modified":"2026-11-09T12:49:55.678500381Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-09T13:27:33.428057Z"},{"id":"AZL-107042","title":"CVE-2026-61801 affecting package buildah 1.43.1-3","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107072","title":"CVE-2026-61801 affecting package cri-o 1.30.1-1","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107099","title":"CVE-2026-61801 affecting package kata-containers-preview 3.27.0~preview2-2","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107111","title":"CVE-2026-61801 affecting package podman 5.6.1-10","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107243","title":"CVE-2026-61801 affecting package containerd2 for versions less than 2.3.7-1","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107261","title":"CVE-2026-61801 affecting package containerized-data-importer for versions less than 1.62.0-9","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107303","title":"CVE-2026-61801 affecting package docker-buildx 0.14.0-17","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107336","title":"CVE-2026-61801 affecting package docker-cli 25.0.7-5","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107360","title":"CVE-2026-61801 affecting package docker-compose for versions less than 2.27.0-16","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107550","title":"CVE-2026-61801 affecting package kata-containers for versions less than 4.1.0.kata1-2","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107571","title":"CVE-2026-61801 affecting package kata-containers-cc for versions less than 3.15.0.aks0-23","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107648","title":"CVE-2026-61801 affecting package kubernetes for versions less than 1.30.10-32","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107664","title":"CVE-2026-61801 affecting package kubevirt for versions less than 1.8.4-4","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"AZL-107691","title":"CVE-2026-61801 affecting package libcontainers-common 20240213-3","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107745","title":"CVE-2026-61801 affecting package moby-engine for versions less than 25.0.18-1","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-02T14:16:45.966153079Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-107862","title":"CVE-2026-61801 affecting package runc for versions less than 1.4.3-2","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-07T14:17:49.873691693Z","updated_at":"2026-11-07T14:48:11.583685Z"},{"id":"AZL-107883","title":"CVE-2026-61801 affecting package skopeo for versions less than 1.14.4-15","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"AZL-107916","title":"CVE-2026-61801 affecting package telegraf for versions less than 1.31.0-35","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","status":"published","published":"2026-10-08T17:17:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.199293Z"},{"id":"GO-2026-6686","title":"Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user","description":"Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user","status":"published","published":"2026-10-19T21:08:21Z","modified":"2026-10-19T21:31:35.45867929Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:12152-1","title":"google-osconfig-agent-20261015.00-1.1 on GA media","description":"These are all security issues fixed in the google-osconfig-agent-20261015.00-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-16T00:00:00Z","modified":"2026-10-17T10:00:05.087985793Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12235-1","title":"containerized-data-importer1.65-api-1.65.0-4.1 on GA media","description":"These are all security issues fixed in the containerized-data-importer1.65-api-1.65.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-23T00:00:00Z","modified":"2026-10-24T17:23:10.301324592Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12260-1","title":"buildpacks-cli-0.40.10-1.1 on GA media","description":"These are all security issues fixed in the buildpacks-cli-0.40.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-24T00:00:00Z","modified":"2026-10-25T17:30:03.893920917Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:24374-1","title":"Security update for google-osconfig-agent","description":"This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2026-61801: github.com/moby/sys/user: unbounded parsing of user and group database files can lead to denial of\n  service (bsc#1284870).\n- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285283).\n- CVE-2026-95838: github.com/containerd/containerd: processing of certain image layers causes superlinear time\n  complexity in unpack handler and can lead to DoS (bsc#1285135).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20261015.00\n * Add scalibr os benchmarks (#1044)\n","status":"published","published":"2026-10-26T06:59:50Z","modified":"2026-10-27T17:23:17.398946903Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}