github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-61801 · Microsoft / collected KEV context

EUVD-2026-95094

GHSA-mjcv-p78q-w5fw

GO-2026-6686

cve-program · CVE-2026-61801

• https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
• https://github.com/moby/sys/pull/221
• https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe

euvd · EUVD-2026-95094

• https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
• https://github.com/moby/sys/pull/221
• https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe

nvd · CVE-2026-61801

• https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
• https://github.com/moby/sys/pull/221
• https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw

osv · GHSA-mjcv-p78q-w5fw

• https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
• https://github.com/moby/sys/pull/221
• https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
• https://github.com/moby/sys

osv · GO-2026-6686

• https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
• https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
• https://github.com/moby/sys/pull/221

• The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`… · Advisory content revised · 30 Oct 2026