PT-2026-25101 · Go · Github.Com/Chainguard-Dev/Malcontent

Published 2026-03-02 · Updated 2026-03-02

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.

This report is an aggregate of these individual reports for the affected code:

Advisory	Affected File
GHSA-jjgh-mc5q-gch7	pkg/action/scan.go
GHSA-mwmf-fxh2-w4x7	pkg/archive/deb.go
GHSA-p8j3-rpf5-gwv3	pkg/archive/gzip.go
GHSA-qfh4-7f5v-75gq	pkg/archive/zlib.go
GHSA-wxxf-r586-5rf5	pkg/archive/bzip2.go

Fix: #1354, #1355, #1356, #1361

Acknowledgements

Thank you to Oleh Konko from 1seal for discovering and reporting all six of these issues.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-54P8-X2M9-C593

Affected Products

Github.Com/Chainguard-Dev/Malcontent

References · 7

• https://osv.dev/vulnerability/GHSA-54p8-x2m9-c593 · Vendor Advisory
• https://github.com/chainguard-dev/malcontent/pull/1354 · Note
• https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-54p8-x2m9-c593 · Note
• https://github.com/chainguard-dev/malcontent/pull/1361 · Note
• https://github.com/chainguard-dev/malcontent/pull/1355 · Note
• https://github.com/chainguard-dev/malcontent/pull/1356 · Note
• https://github.com/chainguard-dev/malcontent · Note