{"id":"EUVD-2026-95094","revision":"cc77a2e676d44ca2aa7a38fdcda34654","records":[{"revision":"cc77a2e676d44ca2aa7a38fdcda34654","observedAt":"2026-11-07T13:27:15.92+00:00","statement":{"source":"euvd","id":"EUVD-2026-95094","aliases":["CVE-2026-61801","GHSA-mjcv-p78q-w5fw"],"title":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`…","description":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5,"severity":null}],"references":["https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw","https://github.com/moby/sys/pull/221","https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95094","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 8, 2026, 4:22:25 PM","dateUpdated":"Oct 8, 2026, 5:27:37 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:24374-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-61801","CVE-2026-78669","CVE-2026-95838"]},{"id":"RHSA-2026:76448","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-13719","CVE-2026-13720","CVE-2026-56851","CVE-2026-61801","CVE-2026-81841","CVE-2026-97394","CVE-2026-101899"]},{"id":"RHSA-2026:76677","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-56851","CVE-2026-61801","CVE-2026-95502","CVE-2026-97394","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-101899","CVE-2026-109855"]},{"id":"openSUSE-SU-2026:12260-1","title":"buildpacks-cli-0.40.10-1.1 on GA media","vulnerabilityIds":["CVE-2026-111943","CVE-2026-17106","CVE-2026-61801","CVE-2026-78659","CVE-2026-78662"]},{"id":"openSUSE-SU-2026:12235-1","title":"containerized-data-importer1.65-api-1.65.0-4.1 on GA media","vulnerabilityIds":["CVE-2026-61801","CVE-2026-78659","CVE-2026-78660","CVE-2026-78669","CVE-2026-84445"]},{"id":"RHSA-2026:76430","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-13719","CVE-2026-13720","CVE-2026-56851","CVE-2026-61801","CVE-2026-76154","CVE-2026-81841","CVE-2026-97394","CVE-2026-101899"]},{"id":"openSUSE-SU-2026:12152-1","title":"google-osconfig-agent-20261015.00-1.1 on GA media","vulnerabilityIds":["CVE-2026-61801","CVE-2026-78669","CVE-2026-95838"]},{"id":"msrc_CVE-2026-61801","title":"github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files","vulnerabilityIds":["CVE-2026-61801"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-95094","identifiers":["EUVD-2026-95094","CVE-2026-61801","GHSA-mjcv-p78q-w5fw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}