Memory Consumption Issue in Moby Sys User Package

CVE-2026-61801

What is CVE-2026-61801?

The Moby sys package, specifically the user utilities for parsing Unix-style database files, was found to have a vulnerability where previous versions lacked sufficient parsing limits on entries in files like /etc/passwd and /etc/group. If exploited, an attacker can use a specially crafted file to induce excessive memory consumption, risking process termination due to out-of-memory conditions. This vulnerability has been addressed in version 0.4.1. As a preventative measure, it's advised to refrain from parsing untrusted user or group database files and to validate inputs thoroughly before parsing.

References