{"id":"AZL-107303","summary":"CVE-2026-61801 affecting package docker-buildx 0.14.0-17","details":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","modified":"2026-10-13T05:35:23Z","published":"2026-10-08T17:17:17Z","upstream":["CVE-2026-61801"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801"}],"affected":[{"package":{"name":"docker-buildx","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/docker-buildx"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.0-17"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-107303.json"}}],"schema_version":"1.9.0"}