CVE-2026-61801: github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

October 8, 2026

A denial-of-service (DoS) vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions.

References

github.com/advisories/GHSA-mjcv-p78q-w5fw
github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
github.com/moby/sys/pull/221
github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
nvd.nist.gov/vuln/detail/CVE-2026-61801

Code Behaviors & Features

Detect and mitigate CVE-2026-61801 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →