PT-2026-26768 · Syft · Syft

Htrgouvea · Published 2026-03-20 · Updated 2026-04-01 · CVE-2026-33481

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Syft versions prior to 1.42.3

Description Syft did not properly remove temporary files if temporary storage became full during a scan. This occurred when unpacking archives, specifically with large or highly compressed archives. The issue caused Syft to exit without deleting temporary files, leading to depletion of temporary storage and potentially preventing future Syft runs or other system utilities from functioning correctly.

Recommendations Update to version 1.42.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-460

Related Identifiers

CLEANSTART-2026-WN01990

CVE-2026-33481

GHSA-RJCW-VG7J-M9RC

GO-2026-4809

SUSE-SU-2026:1135-1

Affected Products

Syft

References · 216

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33481.json · Exploit
• https://github.com/anchore/syft/security/advisories/GHSA-rjcw-vg7j-m9rc · Vendor Advisory
• https://github.com/anchore/syft/pull/4668 · Patch
• https://github.com/anchore/syft/pull/4629 · Patch
• https://github.com/anchore/stereoscope/pull/537 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27141 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22703 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23991 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23831 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33481 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25934 · Security Note