Description
The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moby | sys | < 0.4.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-moby-sys | 0.0~git20260904.79376e0-1 | — |
| Debian 13 | golang-github-moby-sys | No fix yet | — |
| Debian 12 | golang-github-moby-sys | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-moby-sys | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-moby-sys | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-moby-sys | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.12-0.4.hum1 | RHSA-2026:76677 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.7-0.1.hum1 | RHSA-2026:76448 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.3-0.1.hum1 | RHSA-2026:76430 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | google-osconfig-agent | 20261015.00-159998.1.1 | SUSE-SU-2026:24374-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | buildpacks-cli | 0.40.10-1.1 | openSUSE-SU-2026:12260-1 |
| openSUSE Tumbleweed | containerized-data-importer1.65 | 1.65.0-4.1 | openSUSE-SU-2026:12235-1 |
| openSUSE Tumbleweed | google-osconfig-agent | 20261015.00-1.1 | openSUSE-SU-2026:12152-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | buildah | 2:1.43.1-1.amzn2023.0.4 | ALAS2023-2026-3451 |
| Amazon Linux 2023 | containerd +1 | 2.3.7-1.amzn2023.0.1 | ALAS2023-2026-3273 |
| Amazon Linux 2023 | docker | 25.0.18-1.amzn2023.0.1 | ALAS2023-2026-3266 |
| Amazon Linux 2023 | runc | 1.4.3-1.amzn2023.0.3 | ALAS2023-2026-3323 |
| Amazon Linux 2023 | skopeo +1 | 2:1.22.2-1.amzn2023.0.4 | ALAS2023-2026-3450 |
| Amazon Linux 2023 | soci-snapshotter | 0.16.1-1.amzn2023.0.1 | ALAS2023-2026-3351 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | containerd2 | 2.3.7-1 | — |
| Azure Linux 3 | containerized-data-importer | 1.62.0-9 | — |
| Azure Linux 3 | cri-o +6 | No fix yet | — |
| Azure Linux 3 | docker-compose | 2.27.0-16 | — |
| Azure Linux 3 | kata-containers | 4.1.0.kata1-2 | — |
| Azure Linux 3 | kata-containers-cc | 3.15.0.aks0-23 | — |
| Azure Linux 3 | kubernetes | 1.30.10-32 | — |
| Azure Linux 3 | kubevirt | 1.8.4-4 | — |
| Azure Linux 3 | moby-engine | 25.0.18-1 | — |
| Azure Linux 3 | runc | 1.4.3-2 | — |
| Azure Linux 3 | skopeo | 1.14.4-15 | — |
| Azure Linux 3 | telegraf | 1.31.0-35 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | act | 0.2.89-r14 | — |
| Wolfi rolling | ctop | 0.7.7-r45 | — |
| Wolfi rolling | ctr-1 +3 | 1.7.36-r4 | — |
| Wolfi rolling | ctr-2.3 +2 | 2.3.6-r2 | — |
| Wolfi rolling | dagger | 0.21.10-r2 | — |
| Wolfi rolling | dockerd-28 | 28.5.2-r43 | — |
| Wolfi rolling | dogstatsd-7.78 +1 | 7.78.4-r24 | — |
| Wolfi rolling | dogstatsd-7.80 +1 | 7.80.4-r22 | — |
| Wolfi rolling | gosu | 1.19-r19 | — |
| Wolfi rolling | k3d | 5.9.0-r15 | — |
| Wolfi rolling | k3s-1.32 +7 | No fix yet | — |
| Wolfi rolling | k3s-1.34 +1 | 1.34.12.1-r3 | — |
| Wolfi rolling | k3s-1.35 +1 | 1.35.9.1-r3 | — |
| Wolfi rolling | k3s-1.36 +1 | 1.36.5.1-r2 | — |
| Wolfi rolling | k3s-1.37 +1 | 1.37.1.1-r2 | — |
| Wolfi rolling | neuvector-scanner +1 | 4.301-r2 | — |
| Wolfi rolling | newrelic-infrastructure-agent | 1.80.5-r3 | — |
| Wolfi rolling | runc | 1.5.2-r2 | — |
| Wolfi rolling | runc-1.4 | 1.4.3-r9 | — |
| Wolfi rolling | scorecard | 5.5.0-r27 | — |
| Wolfi rolling | undock | 0.14.0-r14 | — |
| Wolfi rolling | vcluster +1 | 0.37.3-r1 | — |
| Wolfi rolling | xeol | 0.10.8-r67 | — |
| Wolfi rolling | zarf | 0.87.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/moby/sys/user | < 0.4.1 | 0.4.1 | GHSA-mjcv-p78q-w5fw |
Advisories 14
- ALAS2023-2026-3266 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3450 Important: skopeo security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3451 Important: buildah security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- WID-SEC-2026-2111 docker: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALAS2023-2026-3351 Moderate: soci-snapshotter security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- SUSE-SU-2026:24374-1 Security update for google-osconfig-agent SUSE / openSUSE Security Updates · Oct 27, 2026
- ALAS2023-2026-3273 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3323 Moderate: runc security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- openSUSE-SU-2026:12260-1 buildpacks-cli-0.40.10-1.1 on GA media SUSE / openSUSE Security Updates · Oct 25, 2026
- openSUSE-SU-2026:12235-1 containerized-data-importer1.65-api-1.65.0-4.1 on GA media SUSE / openSUSE Security Updates · Oct 24, 2026
- RHSA-2026:76448 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76677 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76430 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12152-1 google-osconfig-agent-20261015.00-1.1 on GA media SUSE / openSUSE Security Updates · Oct 17, 2026