CVE-2026-61801

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.

• CWE-400

• https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
• https://github.com/moby/sys/pull/221
• https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61792Weblate is a web-based continuous localization platform used…7.7
• CVE-2026-61793Nuxt OG Image generates OG Images with Vue templates in Nuxt…6.9
• CVE-2026-61794Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-61795Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61800Wazuh is an open-source security platform providing unified …9.1
• CVE-2026-61802Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61803Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61804myTinyWMS is a free, open-source warehouse management system…8.1
• CVE-2026-61805Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61806Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.1