PT-2026-25101 · Go · Github.Com/Chainguard-Dev/Malcontent

Publicado 2026-03-02 · Atualizado 2026-03-02

OSV

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.

This report is an aggregate of these individual reports for the affected code:

Advisory	Affected File
GHSA-jjgh-mc5q-gch7	pkg/action/scan.go
GHSA-mwmf-fxh2-w4x7	pkg/archive/deb.go
GHSA-p8j3-rpf5-gwv3	pkg/archive/gzip.go
GHSA-qfh4-7f5v-75gq	pkg/archive/zlib.go
GHSA-wxxf-r586-5rf5	pkg/archive/bzip2.go

Fix: #1354, #1355, #1356, #1361

Acknowledgements

Thank you to Oleh Konko from 1seal for discovering and reporting all six of these issues.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

GHSA-54P8-X2M9-C593

Produtos afetados

Github.Com/Chainguard-Dev/Malcontent

Referências · 7

• https://github.com/chainguard-dev/malcontent/pull/1354 · Nota
• https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-54p8-x2m9-c593 · Nota
• https://github.com/chainguard-dev/malcontent/pull/1361 · Nota
• https://github.com/chainguard-dev/malcontent/pull/1355 · Nota
• https://github.com/chainguard-dev/malcontent/pull/1356 · Nota
• https://github.com/chainguard-dev/malcontent · Nota
• https://osv.dev/vulnerability/GHSA-54p8-x2m9-c593 · Aviso do Fabricante