---
id: "CVE-2026-61801"
kind: "vulnerability"
aliases: ["CVE-2026-61801", "GHSA-mjcv-p78q-w5fw", "GO-2026-6686"]
title: "Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user"
severity: "medium"
cvss: 5.5
epss: 0.00113
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/moby/sys/user", "fixed": ["0.4.1"], "affected": "< 0.4.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["containers", "docker", "go", "moby", "package"]
not_affected_if: ["no-untrusted-passwd-or-group-input", "version-0.4.1-or-later"]
published_at: "2026-10-08T17:17:17+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:58:10+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6686", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-61801", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61801", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user

github.com/moby/sys/user parses /etc/passwd- and /etc/group-style files without limiting entry count. An attacker who can supply a crafted file can exhaust memory and crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/moby/sys/user affected < 0.4.1 fixed 0.4.1

## How to check

Run `go list -m github.com/moby/sys/user` (or check go.mod) and see whether the version is below 0.4.1.
Run `govulncheck ./...` in the module to see whether the vulnerable parsing functions are reachable.
Check whether any code path passes attacker-controlled passwd or group files to this package.

## Fix

Upgrade github.com/moby/sys/user to 0.4.1 or later.
Until then, do not parse attacker-controlled user or group database files, or validate and limit their size and entry count before parsing.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6686
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-61801
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61801

## From the sources

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_