CVE-2026-61801
Description
The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
How to fix
- github.com/moby/sys/user0.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/moby/sys/userGo | v < 0.4.1 | 0.4.1 |
| microsoft azl3_containerd2_2.3.4-1 | No range specified | — |
| microsoft azl3_containerized-data-importer_1.62.0-8 | No range specified | — |
| microsoft azl3_docker-compose_2.27.0-14 | No range specified | — |
| microsoft azl3_kata-containers_4.1.0.kata0-1 | No range specified | — |
| microsoft azl3_kata-containers-cc_3.15.0.aks0-21 | No range specified | — |
| microsoft azl3_kubernetes_1.30.10-30 | No range specified | — |
| microsoft azl3_kubevirt_1.8.4-2 | No range specified | — |
| microsoft azl3_moby-engine_25.0.3-20 | No range specified | — |
| microsoft azl3_runc_1.4.3-1 | No range specified | — |
| microsoft azl3_skopeo_1.14.4-13 | No range specified | — |
| microsoft azl3_telegraf_1.31.0-33 | No range specified | — |
| microsoft azl3_kata-containers_4.1.0.kata1-2 | No range specified | — |
| microsoft azl3_kata-containers-cc_3.15.0.aks0-23 | No range specified | — |
| microsoft azl3_kubernetes_1.30.10-32 | No range specified | — |
| microsoft azl3_runc_1.4.3-2 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.