Microsoft security update for CVE-2026-61801
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61801. This page also shows what EchelonGraph holds for CVE-2026-61801, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products18
- azl3 containerd2 2.3.4-1 on Azure Linux 3.0
- azl3 containerized-data-importer 1.62.0-8 on Azure Linux 3.0
- azl3 docker-compose 2.27.0-14 on Azure Linux 3.0
- azl3 kata-containers 4.1.0.kata0-1 on Azure Linux 3.0
- azl3 kata-containers 4.1.0.kata1-2 on Azure Linux 3.0
- azl3 kata-containers-cc 3.15.0.aks0-21 on Azure Linux 3.0
- azl3 kata-containers-cc 3.15.0.aks0-23 on Azure Linux 3.0
- azl3 kubernetes 1.30.10-30 on Azure Linux 3.0
- azl3 kubernetes 1.30.10-32 on Azure Linux 3.0
- azl3 kubevirt 1.8.4-2 on Azure Linux 3.0
- azl3 moby-engine 25.0.3-20 on Azure Linux 3.0
- azl3 runc 1.4.3-1 on Azure Linux 3.0
- azl3 runc 1.4.3-2 on Azure Linux 3.0
- azl3 skopeo 1.14.4-13 on Azure Linux 3.0
- azl3 telegraf 1.31.0-33 on Azure Linux 3.0
- azl4 cri-o 1.32.0-7.azl4 on Azure Linux 4.0
- azl4 oci-seccomp-bpf-hook 1.2.10-14.azl4 on Azure Linux 4.0
- azl4 telegraf 1.38.2-5.azl4 on Azure Linux 4.0
✅ Updates Microsoft lists: 12 updates
12 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | 2.3.7-1 |
| — | Security Update | 1.62.0-9 |
| — | Security Update | 2.27.0-16 |
| — | Security Update | 4.1.0.kata1-2 |
| — | Security Update | 3.15.0.aks0-23 |
| — | Security Update | 1.30.10-32 |
| — | Security Update | 1.8.4-4 |
| — | Security Update | 25.0.18-1 |
| — | Security Update | 1.4.3-2 |
| — | Security Update | 1.14.4-14 |
| — | Security Update | 1.31.0-35 |
| — | Security Update | — |
🧭 EchelonGraph on CVE-2026-61801
- EchelonGraph score
- 5.5 MEDIUM
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.
Published by GitHub, Inc., the CVE Numbering Authority that assigned CVE-2026-61801, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).