CVE-2026-61801
ADVISORY - githubSummary
A denial-of-service (DoS) vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions.
This issue is related to containerd [CVE-2026-47262] / GHSA-jpcc-p29g-p8mq, which describes one practical exploitation path through processing untrusted container image content. Applications using github.com/moby/sys/user to parse untrusted user or group database files may be similarly affected.
Impact
github.com/moby/sys/user versions before v0.4.1 do not place sufficient limits on entries while parsing user and group database files. A specially crafted file may cause excessive memory consumption, potentially leading to process termination due to Out Of Memory (OOM) conditions.
Applications that use github.com/moby/sys/user to parse user-supplied or otherwise untrusted /etc/passwd or /etc/group files may be affected. The severity depends on whether an attacker can influence the contents of files being parsed.
Patches
This issue is fixed in github.com/moby/sys/user v0.4.1. Users should upgrade to v0.4.1 or later.
Workarounds
Avoid parsing attacker-controlled /etc/passwd or /etc/group-style files with affected versions of github.com/moby/sys/user.
Applications that must process untrusted user or group database files should validate and limit accepted input before parsing. Upgrading to v0.4.1 or later is the recommended remediation.
References
- containerd CVE-2026-47262 / GHSA-jpcc-p29g-p8mq: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq
- Fix in
github.com/moby/sys/user: https://github.com/moby/sys/user/commit/210d32ba2bcb4544ee968c7f31249fe59796e60b
Common Weakness Enumeration (CWE)
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption
Allocation of Resources Without Limits or Throttling
NIST
1.8
CVSS SCORE
5.5mediumGitHub
1.8
CVSS SCORE
5.5mediumDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumRed Hat
1.8
CVSS SCORE
5.5mediumChainguard
CGA-h98c-w2fp-466c
-
minimos
MINI-22wr-c22j-3fm5
-
minimos
MINI-24rv-pw43-r628
-
minimos
MINI-2jmr-p98p-fx8x
-
minimos
MINI-2x6j-p5hm-95qq
-
minimos
MINI-328p-5574-q27f
-
minimos
MINI-3g9r-jm29-p834
-
minimos
MINI-3gff-jw9m-cgxw
-
minimos
MINI-3j98-jpcx-7x89
-
minimos
MINI-3p83-7g55-rf56
-
minimos
MINI-3xf5-vg42-fjqf
-
minimos
MINI-42gr-5vgf-7g3h
-
minimos
MINI-44p9-jcjx-wrh8
-
minimos
MINI-45j3-j6mg-p69m
-
minimos
MINI-4hcv-8h4h-3gcg
-
minimos
MINI-5r7v-p852-p4w7
-
minimos
MINI-5w9w-rh5r-c8w5
-
minimos
MINI-64f3-7c8g-w2g7
-
minimos
MINI-6f8r-34f4-j4p3
-
minimos
MINI-6fj7-78x4-ppr2
-
minimos
MINI-6hmx-xjvq-cjh9
-
minimos
MINI-7527-fg43-f4pf
-
minimos
MINI-77j7-hhj4-7xq5
-
minimos
MINI-7cmv-x5mh-8m57
-
minimos
MINI-7hf4-mjqw-438f
-
minimos
MINI-7j93-j9r9-cv85
-
minimos
MINI-7m9r-xqvx-rqv9
-
minimos
MINI-7qhx-m4rq-5r62
-
minimos
MINI-7rp9-887m-vgg3
-
minimos
MINI-822v-fw3r-6p4v
-
minimos
MINI-826h-p47f-35g9
-
minimos
MINI-8648-9m28-33rg
-
minimos
MINI-873q-cq38-7w6f
-
minimos
MINI-89w3-4f75-p6jq
-
minimos
MINI-8gp3-2m68-q53x
-
minimos
MINI-8hrg-659m-r972
-
minimos
MINI-8p97-7hrr-8r45
-
minimos
MINI-8pj9-46g5-g6cf
-
minimos
MINI-8pqp-25qq-vw66
-
minimos
MINI-8q96-x553-hp22
-
minimos
MINI-8x5f-m77g-m374
-
minimos
MINI-93rh-vr3p-qfhw
-
minimos
MINI-9j47-cmg5-77r5
-
minimos
MINI-9mh6-g79r-pcq2
-
minimos
MINI-9rj9-8vf5-r49f
-
minimos
MINI-9v93-7qrw-7r55
-
minimos
MINI-c4gf-235r-69xr
-
minimos
MINI-c5hr-p6gc-8732
-
minimos
MINI-c5xc-j6jp-88xr
-
minimos
MINI-cg66-276g-w6cp
-
minimos
MINI-cq87-jc2p-xf42
-
minimos
MINI-cqj3-xqq5-ph5v
-
minimos
MINI-cwqh-hx85-j27v
-
minimos
MINI-f577-jm2v-fpj2
-
minimos
MINI-f6qx-432x-rwjv
-
minimos
MINI-fcfp-p7fg-75hv
-
minimos
MINI-ffhq-xp3f-rvj8
-
minimos
MINI-fgr2-m3fj-mmrg
-
minimos
MINI-fh56-586g-vqj2
-
minimos
MINI-fhjv-45xf-444f
-
minimos
MINI-fp4c-c42c-2p56
-
minimos
MINI-fpmq-vr36-2qw3
-
minimos
MINI-g3mg-8v34-4qpc
-
minimos
MINI-g426-pf49-gqjm
-
minimos
MINI-g5v7-8v27-q9qx
-
minimos
MINI-g6mc-v67j-c233
-
minimos
MINI-g7x8-v57m-5j84
-
minimos
MINI-gm4c-xx2w-8wxr
-
minimos
MINI-gq2g-rr6g-gjwv
-
minimos
MINI-gqp2-c5qm-943q
-
minimos
MINI-gv25-6m2v-7f2w
-
minimos
MINI-gx65-rhp5-25xc
-
minimos
MINI-h499-m785-hf3m
-
minimos
MINI-h6q4-6x96-v3g4
-
minimos
MINI-hc66-66gh-4w5g
-
minimos
MINI-hh4v-gffh-r64j
-
minimos
MINI-hj3r-xv77-9xjg
-
minimos
MINI-hrj4-8mpg-x85q
-
minimos
MINI-j68f-3mm7-53fx
-
minimos
MINI-j9m9-jvv6-rqj6
-
minimos
MINI-jjc4-g552-4ppc
-
minimos
MINI-jmm8-ppqq-4rh8
-
minimos
MINI-jrfj-6vp6-7qj3
-
minimos
MINI-m58q-rfqf-x35v
-
minimos
MINI-m9m6-8jgm-92wf
-
minimos
MINI-mgrj-56cp-hq94
-
minimos
MINI-mphf-x8c8-pqwp
-
minimos
MINI-mrhf-v23h-xwg5
-
minimos
MINI-p2gg-m3c5-w7pr
-
minimos
MINI-p35q-pjxp-cjmq
-
minimos
MINI-p46q-fj8x-9555
-
minimos
MINI-p7g2-gvj3-88g8
-
minimos
MINI-p7gj-9qv6-xmm9
-
minimos
MINI-p95j-rrpv-r3qf
-
minimos
MINI-pf3j-8vhc-p57p
-
minimos
MINI-pqxc-hg8p-9cx4
-
minimos
MINI-pv6w-6f89-gp9w
-
minimos
MINI-q4mj-qwvj-vc9m
-
minimos
MINI-q5gj-hqgg-92fv
-
minimos
MINI-q945-7qfw-87qp
-
minimos
MINI-qvwx-x3w6-m65v
-
minimos
MINI-r389-2whw-8f8g
-
minimos
MINI-r77x-3gxr-92q9
-
minimos
MINI-rm2f-fvxc-gxc7
-
minimos
MINI-rm7q-g759-xch3
-
minimos
MINI-rmmf-h2pw-5524
-
minimos
MINI-rrxr-823h-qrh4
-
minimos
MINI-rw6p-r689-w3xw
-
minimos
MINI-v239-3wj4-p9jf
-
minimos
MINI-v67w-g9fc-9r8g
-
minimos
MINI-v6q4-q6xq-cv4c
-
minimos
MINI-v7j8-465r-c3g3
-
minimos
MINI-vfhh-322c-c8mg
-
minimos
MINI-vfpc-3jr2-4r6w
-
minimos
MINI-vmv6-x329-g928
-
minimos
MINI-vq4f-2wp5-j23g
-
minimos
MINI-vw54-8c25-pff2
-
minimos
MINI-wg8x-5p7c-64mj
-
minimos
MINI-whcw-7hfw-jxfv
-
minimos
MINI-wrh4-48cx-h8g2
-
minimos
MINI-wrrh-vqch-vgfq
-
minimos
MINI-x46x-v9w2-wfh6
-
minimos
MINI-x5f2-gjv9-5259
-
minimos
MINI-x8rw-3572-3jf2
-
minimos
MINI-xgfx-4748-hqhf
-
minimos
MINI-xhcj-rqrw-5fxg
-
minimos
MINI-xjf4-xxrw-x75r
-