{"id":"AZL-107111","summary":"CVE-2026-61801 affecting package podman 5.6.1-10","details":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","modified":"2026-10-13T05:33:33Z","published":"2026-10-08T17:17:17Z","upstream":["CVE-2026-61801"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801"}],"affected":[{"package":{"name":"podman","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/podman"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.6.1-10"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107111.json"}}],"schema_version":"1.9.0"}