{"id":"CVE-2026-61801","kind":"vulnerability","aliases":["CVE-2026-61801","GHSA-mjcv-p78q-w5fw","GO-2026-6686"],"related":[],"title":"Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","summary":"github.com/moby/sys/user parses /etc/passwd- and /etc/group-style files without limiting entry count. An attacker who can supply a crafted file can exhaust memory and crash the process.","severity":"medium","cvss":5.5,"epss":0.00113,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/moby/sys/user","fixed":["0.4.1"],"affected":"< 0.4.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["containers","docker","go","moby","package"],"not_affected_if":["no-untrusted-passwd-or-group-input","version-0.4.1-or-later"],"how_to_check":"Run `go list -m github.com/moby/sys/user` (or check go.mod) and see whether the version is below 0.4.1.\nRun `govulncheck ./...` in the module to see whether the vulnerable parsing functions are reachable.\nCheck whether any code path passes attacker-controlled passwd or group files to this package.","fix":"Upgrade github.com/moby/sys/user to 0.4.1 or later.\nUntil then, do not parse attacker-controlled user or group database files, or validate and limit their size and entry count before parsing.","status":"open","published_at":"2026-10-08T17:17:17+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:58:10+00:00","updated_at":"2026-10-23T19:58:10+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:58:10Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/moby/sys/user to 0.4.1 or later.\nUntil then, do not parse attacker-controlled user or group database files, or validate and limit their size and entry count before parsing.","summary":"github.com/moby/sys/user parses /etc/passwd- and /etc/group-style files without limiting entry count. An attacker who can supply a crafted file can exhaust memory and crash the process.","category":"package","who_cares":["go","moby","docker","containers"],"confidence":0.8,"analyst_note":"","how_to_check":"Run `go list -m github.com/moby/sys/user` (or check go.mod) and see whether the version is below 0.4.1.\nRun `govulncheck ./...` in the module to see whether the vulnerable parsing functions are reachable.\nCheck whether any code path passes attacker-controlled passwd or group files to this package.","needs_analyst":false,"not_affected_if":["version-0.4.1-or-later","no-untrusted-passwd-or-group-input"],"severity_if_unknown":"medium"},"cost_usd":0.000407,"input_tokens":2241,"output_tokens":365,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A,28A '-61801':18A,29A '-6686':26A '/etc/group':100C '/etc/group-style':44B '/etc/passwd':98C '/etc/passwd-':42B '/moby/sys/user':15A,32A,40B,68C '0.4.1':90C,138C 'affect':122C 'allow':103C 'attack':51B,105C,145C 'attacker-control':144C 'avoid':142C 'caus':114C 'condit':131C 'consumpt':117C 'contain':33B 'control':146C 'count':49B 'craft':56B,111C 'crash':62B 'cve':16A,27A 'databas':10A,86C,150C 'docker':34B 'dos':2A 'due':124C 'entri':48B,78C,95C 'excess':115C 'exhaust':59B 'file':11A,45B,57B,87C,102C,112C,151C 'ghsa':20A 'ghsa-mjcv-p78q-w5fw':19A 'github.com':14A,31A,39B,67C 'github.com/moby/sys/user':13A,30A,38B,66C 'go':24A,35B,71C 'group':9A,85C,149C 'input':157C 'issu':133C 'limit':47B,94C,155C 'look':76C 'memori':60B,116C,130C 'mjcv':21A 'mobi':36B 'out-of-memori':127C 'p78q':22A 'packag':37B,69C 'pars':5A,41B,74C,97C,143C,159C 'patch':135C 'possibl':1A 'potenti':119C 'process':64B,123C 'provid':70C 'special':110C 'style':82C,101C 'suffici':93C 'suppli':54B,108C 'termin':120C 'unbound':4A 'unix':81C 'unix-styl':80C 'untrust':156C 'user':7A,83C,147C 'util':72C 'valid':153C 'version':88C,137C 'via':3A 'w5fw':23A 'without':46B 'workaround':141C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T17:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6686","url":"https://pkg.go.dev/vuln/GO-2026-6686","severity":null,"published_at":"2026-10-19T21:08:21+00:00","modified_at":"2026-10-19T21:08:21+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-61801","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61801","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-61801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801","severity":null,"published_at":"2026-10-08T17:17:17+00:00","modified_at":"2026-10-08T21:35:53+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}