The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
Fix
Microsoft's update · Moderate
- Release Notes — azl3 containerd2 2.3.4-1 on Azure Linux 3.0 · build 2.3.7-1
- Release Notes — azl3 containerized-data-importer 1.62.0-8 on Azure Linux 3.0 · build 1.62.0-9
- Release Notes — azl3 docker-compose 2.27.0-14 on Azure Linux 3.0 · build 2.27.0-16
- Release Notes — azl3 kubevirt 1.8.4-2 on Azure Linux 3.0 · build 1.8.4-4
- Release Notes — azl3 moby-engine 25.0.3-20 on Azure Linux 3.0 · build 25.0.18-1
- Release Notes — azl3 runc 1.4.3-1 on Azure Linux 3.0 · build 1.4.3-2
- Release Notes — azl3 skopeo 1.14.4-13 on Azure Linux 3.0 · build 1.14.4-14
- Release Notes — azl3 telegraf 1.31.0-33 on Azure Linux 3.0 · build 1.31.0-35
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-30.
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.5NVD modified 2026-10-08 21:35
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.