Aller au contenu
Se connecter
6.9 Moyenne

CVE-2026-54448 Trivy is a security scanner

Description

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

Produits et versions touchés

Produit Versions touchées Corrigé en
trivy 0.71 premières → < 0.71.0 0.71.0

Autres CVE de trivy

Les 5 CVE de trivy →
CVE-2026-63328 Trivy is a security scanner 6.8 Moyenne CVE-2026-55092 Trivy is a security scanner 7.0 Élevée CVE-2026-33634 Aquasecurity Trivy Embedded Malicious Code Vulnerability 9.4 Critique CVE-2024-35192 Trivy is a security scanner 5.5 Moyenne
Suivre cette CVE