CVE-2026-54448
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Jun 25, 2026
CISA due date
—
The record
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | trivy | 0 | 0.71.2-2.1 |
Related vulnerabilities
- CVE-2026-53492 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-53489 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-50195 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-47262 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-53488 containerd is an open-source container runtime. Also affects trivy
- CVE-2026-55092 Trivy is a security scanner. Also affects trivy
- CVE-2026-44740 Billy is an interface filesystem abstraction for Go. Also affects trivy
- CVE-2026-27136 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects trivy