Most recent entries from all

fkie_cve-2026-61801

2026-10-11T20:34:22.117033+00:00

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.

GHSA-mjcv-p78q-w5fw — github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

2026-10-11T20:34:22.117136+00:00

Affected: Go: github.com/moby/sys/user

A denial-of-service (DoS) vulnerability exists in `github.com/moby/sys/user` before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious `/etc/passwd` or `/etc/group`-style file may cause excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions.

This issue is related to containerd [CVE-2026-47262] / [GHSA-jpcc-p29g-p8mq](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq), which describes one practical exploitation path through processing untrusted container image content. Applications using `github.com/moby/sys/user` to parse untrusted user or group database files may be similarly affected.

### Impact

`github.com/moby/sys/user` versions before v0.4.1 do not place sufficient limits on entries while parsing user and group database files. A specially crafted file may cause excessive memory consumption, potentially leading to process termination due to Out Of Memory (OOM) conditions.

Applications that use `github.com/moby/sys/user` to parse user-supplied or otherwise untrusted `/etc/passwd` or `/etc/group` files may be affected. The severity depends on whether an attacker can influence the contents of files being parsed.

### Patches

This issue is fixed in `github.com/moby/sys/user` v0.4.1. Users should upgrade to v0.4.1 or later.

### Workarounds

Avoid parsing attacker-controlled `/etc/passwd` or `/etc/group`-style files with affecte…

msrc_CVE-2026-61801 — github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

2026-10-11T20:34:22.117222+00:00

msrc_CVE-2026-61801

RHSA-2026:76430 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-11T20:34:22.117254+00:00

github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards