[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/moby/sys/user	v0.3.0 → v0.4.1

---

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

CVE-2026-61801 / GHSA-mjcv-p78q-w5fw

More information

Details

A denial-of-service (DoS) vulnerability exists in github.com/moby/sys/user before v0.4.1 when parsing specially crafted user or group database files. An attacker able to supply a malicious /etc/passwd or /etc/group-style file may cause excessive memory consumption, potentially resulting in process termination due to Out Of Memory (OOM) conditions.

This issue is related to containerd [CVE-2026-47262] / GHSA-jpcc-p29g-p8mq, which describes one practical exploitation path through processing untrusted container image content. Applications using github.com/moby/sys/user to parse untrusted user or group database files may be similarly affected.

Impact

github.com/moby/sys/user versions before v0.4.1 do not place sufficient limits on entries while parsing user and group database files. A specially crafted file may cause excessive memory consumption, potentially leading to process termination due to Out Of Memory (OOM) conditions.

Applications that use github.com/moby/sys/user to parse user-supplied or otherwise untrusted /etc/passwd or /etc/group files may be affected. The severity depends on whether an attacker can influence the contents of files being parsed.

Patches

This issue is fixed in github.com/moby/sys/user v0.4.1. Users should upgrade to v0.4.1 or later.

Workarounds

Avoid parsing attacker-controlled /etc/passwd or /etc/group-style files with affected versions of github.com/moby/sys/user.

Applications that must process untrusted user or group database files should validate and limit accepted input before parsing. Upgrading to v0.4.1 or later is the recommended remediation.

References

• containerd CVE-2026-47262 / GHSA-jpcc-p29g-p8mq: GHSA-jpcc-p29g-p8mq
• Fix in github.com/moby/sys/user: https://github.com/moby/sys/user/commit/210d32ba2bcb4544ee968c7f31249fe59796e60b

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw
• https://github.com/moby/sys/pull/221
• https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe
• https://github.com/advisories/GHSA-mjcv-p78q-w5fw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

moby/sys (github.com/moby/sys/user)

v0.4.1

What's Changed

• user: prevent possible DoS via unbounded parsing of user and group database files in CVE-2026-61801 / GHSA-mjcv-p78q-w5fw. This fixes a similar issue as CVE-2026-47262 in containerd.
• user: prevent falling back to looking up numeric usernames and improve handling of numeric user/group to prevent looking up numeric values as usernames. This fixes a similar issue as CVE-2026-46680 in containerd. #​221
• user: bump Go to 1.18, modernize #​198
• user: make code a bit more DRY #​225
• user: test cleanups #​226

Full Changelog: moby/sys@user/v0.4.0...user/v0.4.1

v0.4.0: user v0.4.0

This release merges the github.com/moby/moby/pkg/idtools package
functionality. The package was previously trimmed down and is simplified
further to better fit moby/sys.

Now the package interface will just expand with:

• MkdirAllAndChown with WithOnlyNew as a MkdirOpt
• MkdirAndChown also supporting the opts
• IdentityMapping its functions RootPair, ToHost, ToContainer, Empty

Note that the Identity type is gone since SID was not used in the
package or by any of the functions. It is more common to just pass the
uid and gid.

What's Changed

• Merge functionality from github.com/moby/moby/pkg/idtools into user #​182
• Makefile: fix error from test #​172
• Add go fix to CI, rm old build tags #​148
• Add Go 1.23, drop 1.21, bump golangci-lint #​147
• ci: fix not honoring PACKAGES setting in gha Windows runners #​157
• ci: checkout first, disable go caching #​160
• ci: add unparam linter #​158
• ci: Update macOS runner image to macOS 13 #​167
• ci: add codespell #​159
• ci: add codecov #​180

Full Changelog: moby/sys@user/v0.3.0...user/v0.4.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.