Bug 2548048 (CVE-2026-61801)

Summary:	CVE-2026-61801 github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, akhatavk, akoudelk, alizardo, amctagga, anpicker, aoconnor, aos-team-art-private, aprice, asatyam, asdas, asegurap, bbrownin, bniver, bparees, cahl, cdrage, cmah, crizzo, dfreiber, dhanak, diagrawa, dkeler, doconnor, dpaolell, drosa, drow, dschmidt, dsimansk, dymurray, eaguilar, ebaron, eborisov, ebourniv, eglynn, flucifre, gbenhaim, gmeno, gparvin, groman, gtanzill, hasun, hoberger, ibolton, ikhan, jbalunas, jburrell, jbuscemi, jcantril, jchui, jdelft, jfula, jhe, jjoyce, jlanda, jmatsuok, jmatthew, jmontleo, jowilson, jpretori, jsamir, jschluet, jtolenti, jupierce, kaycoth, kbempah, kingland, kshier, ktsao, lball, lbragsta, lchilton, lgamliel, lgarciaa, lhh, ljawale, lpele, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, mnovotny, msilmser, nboldt, ngough, niyer, nyancey, oaljalju, oezr, ometelka, pakotvan, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rbobbitt, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, rushinde, sabiswas, sakbas, sarad, sausingh, sbratsla, sbunciak, sdawley, sfeifer, sghai, sidsharm, simaishi, slucidi, solenoci, sostapov, sprizend, sseago, stcannon, sthirugn, suppawar, syedriko, thason, tsze, twaugh, tzivkovi, vereddy, veshanka, vkumar, vlaad, vvoronko, watson-tool-maintainers, wenshen, whayutin, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a Denial of Service (DoS) condition by crashing the affected process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2548481, 2548482, 2548483, 2548484, 2548485, 2548486, 2548487, 2548492, 2548493, 2548494, 2548495, 2548496, 2548497, 2548498, 2548499, 2548500, 2548502, 2548503, 2548505, 2548506, 2548508, 2548515, 2548516, 2548517, 2548518, 2548519, 2548520, 2548521, 2548522, 2548523, 2548524, 2548525, 2548526, 2548527, 2548528, 2548529, 2548530, 2548531, 2548532, 2548533, 2548534, 2548535, 2548536, 2548537, 2548539, 2550351, 2548488, 2548491, 2548507, 2548514
Bug Blocks:

Description OSIDB Bzimport 2026-10-08 16:41:48 UTC

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.