Unbounded parsing in moby/sys/user lets attackers exhaust memory
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 52 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The github.com/moby/sys/user Go package before 0.4.1 is affected. It does not sufficiently limit entries when parsing /etc/passwd or /etc/group style files, a flaw classified as CWE-400 (Uncontrolled Resource Consumption). An attacker who can supply a specially crafted file can exhaust memory and terminate the affected process.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| moby | sys | before 0.4.1 | 0.4.1 | Patch available | CNA |
| — | github.com/moby/sys/user (Go) | before 0.4.1 | 0.4.1 | Patch available | GHSA-mjcv-p78q-w5fw |
- sys Vendormoby Affected before 0.4.1 Fixed in 0.4.1 Patch available CNA
- github.com/moby/sys/user (Go) Vendor— Affected before 0.4.1 Fixed in 0.4.1 Patch available GHSA-mjcv-p78q-w5fw
Remediation
Upgrade github.com/moby/sys/user to 0.4.1, and moby/sys to 0.4.1. Red Hat fixes Red Hat Hardened Images in RHSA-2026:76677, RHSA-2026:76448 and RHSA-2026:76430. Red Hat lists these affected products without a fix, with its plan: Assisted Installer for Red Hat OpenShift Container Platform 2 (no fix planned), Compliance Operator (none available), Confidential Compute Attestation (none available), Cryostat 4 (none available), Custom Metric Autoscaler operator for Red Hat Openshift (none available), and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA sys (moby) Fixed in 0.4.1
- Fix · GHSA-mjcv-p78q-w5fw github.com/moby/sys/user (Go) Fixed in 0.4.1 Advisory →
Red Hat 3 advisories
- RHSA-2026:76677 Released 2026-10-06 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images grafana12.4-12.4.12-0.4.hum1@aarch64, grafana12.4-12.4.12-0.4.hum1@src, grafana12.4-12.4.12-0.4.hum1@x86_64
- RHSA-2026:76448 Released 2026-10-05 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images grafana13.1-13.1.7-0.1.hum1@aarch64, grafana13.1-13.1.7-0.1.hum1@src, grafana13.1-13.1.7-0.1.hum1@x86_64
- RHSA-2026:76430 Released 2026-10-05 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images grafana13.2-13.2.3-0.1.hum1@aarch64, grafana13.2-13.2.3-0.1.hum1@src, grafana13.2-13.2.3-0.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix planned: Out of support scope |
| Compliance Operator | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| DPU kit for NVIDIA | Affected | No fix yet: Fix deferred |
| Exploit Intelligence | Affected | No fix planned: Out of support scope |
| Kernel Module Management Operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| Logical Volume Manager Storage | Affected | No fix yet: Fix deferred |
| Machine Deletion Remediation Operator | Affected | No fix planned: Out of support scope |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix planned: Out of support scope |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift API for Data Protection | Affected | No fix planned: Out of support scope |
| OpenShift Developer Tools and Services | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| OpenShift Source-to-Image (S2I) | Affected | No fix yet: Fix deferred |
| Pen Drive Powered by Red Hat Lightspeed | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Kueue | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix planned: Out of support scope |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift for Windows Containers | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Web Terminal | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:76430, RHSA-2026:76448, RHSA-2026:76677 |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-08 Threatist record created from CVE-2026-61801
- 2026-10-08 Alias added: GHSA-mjcv-p78q-w5fw
- 2026-10-09 Fix available: RHSA-2026:76430 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:76448 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:76677 · Red Hat
- 2026-10-09 Fix available: Red Hat Hardened Images · Red Hat
- 2026-10-09 CVSS score added · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More moby vulnerabilities
- TI-2026-14229 Tar extraction in moby/go-archive can write outside the destination directory via link following CVSS 4.0HIGH 7.1
- TI-2021-12512 Moby HyperKit uninitialized memory use in virtio-sock pci_vtsock_proc_tx CVSS 3.1HIGH 7.1
- TI-2024-27462 Moby authz zero length regression CVSS 3.1CRITICAL 10.0
- TI-2024-15672 BuildKit interactive containers API does not validate entitlements check CVSS 3.1CRITICAL 9.8
- TI-2024-15671 BuildKit possible host system access from mount stub cleaner CVSS 3.1CRITICAL 10.0
- TI-2026-26365 Moby: AuthZ plugin bypass with oversized request body CVSS 3.1HIGH 8.8
Sources
- CVE-2026-61801 · CVE Program
- CVE-2026-61801 · NVD
- FIRST EPSS
- GHSA-mjcv-p78q-w5fw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-61801 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences