CVE-2026-54448
Fixed in a distro release EPSS <1%CVSS 6.9
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.
Products: aquasecurity trivy
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/aquasecurity/trivy | 0.71.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cloudbeat-8.17 | no fix |
| Chainguard | cloudbeat-8.19 | 8.19.18-r2 |
| Chainguard | cloudbeat-9.0 | no fix |
| Chainguard | cloudbeat-9.1 | no fix |
| Chainguard | cloudbeat-9.2 | 9.2.8-r20 |
| Chainguard | cloudbeat-fips-8.17 | no fix |
| Chainguard | cloudbeat-fips-8.19 | 8.19.18-r3 |
| Chainguard | cloudbeat-fips-9.0 | no fix |
| Chainguard | cloudbeat-fips-9.1 | no fix |
| Chainguard | cloudbeat-fips-9.2 | 9.2.8-r28 |
| Chainguard | kubescape | 0 |
| Chainguard | kubescape-server | 0 |
| Chainguard | kubescape-server-downloader | 0 |
| Chainguard | kubescape-server-fips | 0 |
| Chainguard | kubescape-server-fips-downloader | 0 |
| Chainguard | trivy-operator | 0.30.1-r26 |
| Chainguard | trivy-operator-fips | 0.30.1-r23 |
| SUSE Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 |
| Wolfi | kubescape | 0 |
| Wolfi | trivy-operator | 0.30.1-r26 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260727T201416-160000.1.1 |
| openSUSE Leap 16.0 | trivy | 0.72.0-160000.1.1 |
| openSUSE Tumbleweed | trivy | 0.71.2-2.1 |