PT-2026-52498 · Aqua Security · Trivy

Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-54448

Mitre

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

CWE-789

Identificadores relacionados

CVE-2026-54448

Produtos afetados

Trivy

Referências · 3

• https://github.com/aquasecurity/trivy/pull/10718 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-54448 · Nota de Segurança
• https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4 · Nota