CVE-2026-61801

About vulnerability

Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user

Affected product:

ClickHouse/clickhouse-go , Grafana , containerd/containerd , google/cadvisor , grafana/tempo , jaegertracing/jaeger , kubernetes/kubernetes , microsoft/hcsshim , moby/sys/user , open-telemetry/opentelemetry-collector-contrib/connector/spanmetricsconnector , open-telemetry/opentelemetry-collector-contrib/exporter/kafkaexporter , open-telemetry/opentelemetry-collector-contrib/exporter/zipkinexporter , open-telemetry/opentelemetry-collector-contrib/internal/coreinternal , open-telemetry/opentelemetry-collector-contrib/internal/filter , open-telemetry/opentelemetry-collector-contrib/pkg/ottl , open-telemetry/opentelemetry-collector-contrib/pkg/translator/jaeger , open-telemetry/opentelemetry-collector-contrib/pkg/translator/opencensus , open-telemetry/opentelemetry-collector-contrib/pkg/translator/zipkin , open-telemetry/opentelemetry-collector-contrib/processor/filterprocessor , open-telemetry/opentelemetry-collector-contrib/receiver/jaegerreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/kafkareceiver , open-telemetry/opentelemetry-collector-contrib/receiver/opencensusreceiver , open-telemetry/opentelemetry-collector-contrib/receiver/zipkinreceiver , opencontainers/runc , openfga/openfga , pressly/goose , testcontainers/testcontainers-go , testcontainers/testcontainers-go/modules/mysql , testcontainers/testcontainers-go/modules/postgres

Affected packages:

github.com/moby/sys/user @ 0.1.0 (+55 more)