5.5

CVE-2026-61801: moby sys Uncontrolled Resource Consumption

CVSS: 5.5v3.1MediumDeferred
AliasesRHSA-2026:76677DEBIAN-CVE-2026-61801CGA-2453-35xq-jx9r
Published 08-10-2026Last modified 08-10-2026
Open JSON

Vulnerability summary

CVE-2026-61801 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in moby sys. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.3% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.11%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 9 · Downstream 3 · Related 1
CVE-2024-24786CVE-2026-100347CVE-2026-100349CVE-2026-100350CVE-2026-100351CVE-2026-101899

Timeline

  1. 08-10-2026
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.11%

Chance of exploitation in the next 30 days

Percentile

1%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

09-10-202619-10-2026
EPSS score
0.11%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard132 products
  • actAll versions (No fix recorded) | < 0.2.89-r14
  • amazon-ecs-agent< 1.107.0-r3
  • amazon-ecs-agent-fips< 1.108.0-r2
  • chaos-mesh< 2.8.4-r12
  • chaos-mesh-daemon< 2.8.4-r12
Wolfi47 products
  • actAll versions (No fix recorded) | < 0.2.89-r14
  • containerd-1< 1.7.36-r4
  • containerd-2.3< 2.3.6-r2
  • containerd-shim-runc-v2-1< 1.7.36-r4
  • containerd-stress-1< 1.7.36-r4
Debian1 product
  • golang-github-moby-sysAll versions (No fix recorded) | < 0.0~git20260904.79376e0-1
Github.com/moby/sys1 product
  • user< 0.4.1
Moby1 product
Redhat1 product
  • grafana12.4< 0:12.4.12-0.4.hum1
Ubuntu1 product
  • golang-github-moby-sysAll versions (No fix recorded)

7 vendors · 184 products

References

77 links
Show all 77 references