Skip to content
Sign in
6.9 Medium

CVE-2026-54448 Trivy is a security scanner

Description

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

Affected products and versions

Product Affected versions Fixed in
trivy 0.71 earliest → < 0.71.0 0.71.0

Other CVEs of trivy

The 5 CVEs of trivy →
CVE-2026-63328 Trivy is a security scanner 6.8 Medium CVE-2026-55092 Trivy is a security scanner 7.0 High CVE-2026-33634 Aquasecurity Trivy Embedded Malicious Code Vulnerability 9.4 Critical CVE-2024-35192 Trivy is a security scanner 5.5 Medium
Track this CVE