MEDIUM

CVE-2026-54448

Aquasec Trivy 2026-06-25 CVSS v3.1

CVSS

6.5

Description

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

CWE-789

EPSS Score

0.44%

Probability of exploitation in next 30 days

37.9th percentile

References

https://github.com/aquasecurity/trivy/pull/10718 Issue Tracking, Third Party Advisory https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4 Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE