Live › vulnerability › CVE-2026-61801
Go to dashboardgithub.com/moby/sys/user parses /etc/passwd- and /etc/group-style files without limiting entry count. An attacker who can supply a crafted file can exhaust memory and crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/moby/sys/user | go | < 0.4.1 | 0.4.1 |
Run go list -m github.com/moby/sys/user (or check go.mod) and see whether the version is below 0.4.1.
Run govulncheck ./... in the module to see whether the vulnerable parsing functions are reachable.
Check whether any code path passes attacker-controlled passwd or group files to this package.
0.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing /etc/passwd- or /etc/group-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
This page as .md · .json · in your agent: get_signal("CVE-2026-61801")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.