CVE-2026-61801MediumCVSS 5.5

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Published
October 11, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2026-61801 →

🎯 Affected products15

  • azl3 containerd2 2.3.4-1 on Azure Linux 3.0
  • azl3 containerized-data-importer 1.62.0-8 on Azure Linux 3.0
  • azl3 docker-compose 2.27.0-14 on Azure Linux 3.0
  • azl3 kata-containers 4.1.0.kata0-1 on Azure Linux 3.0
  • azl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0
  • azl3 kata-containers-cc 3.15.0.aks0-21 on Azure Linux 3.0
  • azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0
  • azl3 kubernetes 1.30.10-30 on Azure Linux 3.0
  • azl3 kubernetes 1.30.10-32 on Azure Linux 3.0
  • azl3 kubevirt 1.8.4-2 on Azure Linux 3.0
  • azl3 moby-engine 25.0.3-20 on Azure Linux 3.0
  • azl3 runc 1.4.3-1 on Azure Linux 3.0
  • azl3 runc 1.4.3-2 on Azure Linux 3.0
  • azl3 skopeo 1.14.4-13 on Azure Linux 3.0
  • azl3 telegraf 1.31.0-33 on Azure Linux 3.0

✅ Remediation

KBRelease Notes (Security Update) — fixed build 2.3.7-1 KBRelease Notes (Security Update) — fixed build 1.62.0-9 KBRelease Notes (Security Update) — fixed build 2.27.0-16 KBRelease Notes (Security Update) — fixed build 4.1.0.kata1-2 KBRelease Notes (Security Update) — fixed build 3.15.0.aks0-23 KBRelease Notes (Security Update) — fixed build 1.30.10-32 KBRelease Notes (Security Update) — fixed build 1.8.4-4 KBRelease Notes (Security Update) — fixed build 25.0.18-1 KBRelease Notes (Security Update) — fixed build 1.4.3-2 KBRelease Notes (Security Update) — fixed build 1.14.4-14 KBRelease Notes (Security Update) — fixed build 1.31.0-35

🔗 References (2)