PT-2026-52498 · Aqua Security · Trivy

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-54448

NVD

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789

CWE-770

Related Identifiers

CVE-2026-54448

Affected Products

Trivy

References · 3

• 🔥 https://github.com/aquasecurity/trivy/pull/10718 · Exploit
• 🔥 https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54448 · Security Note