{"id":"EUVD-2026-39479","enisaUuid":"a3bb81d7-2be1-3f11-b16c-a7606f475769","description":"Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.","datePublished":"Jun 25, 2026, 4:27:33 PM","dateUpdated":"Jun 25, 2026, 6:55:50 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4\nhttps://github.com/aquasecurity/trivy/pull/10718\n","aliases":"CVE-2026-54448\nGHSA-q3fv-x8vg-qqm4\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"9e3e9279-d47d-37db-a192-ac64cf80752e","product":{"name":"trivy","vendor":{"name":"aquasecurity"}},"product_version":"\u003c 0.71.0"}],"enisaIdVendor":[{"id":"a3074801-bbae-39f1-a9f6-bbbfe0d65a48","vendor":{"name":"aquasecurity"}}],"enisaIdVulnerability":[{"id":"370b0217-2939-3102-bc22-8c0045edf7ca","vulnerability":{"id":"GHSA-q3fv-x8vg-qqm4","description":"Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser","datePublished":"Jul 14, 2026, 7:52:14 PM","dateUpdated":"Jul 14, 2026, 7:52:14 PM","baseScore":0.0,"references":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54448\nhttps://github.com/aquasecurity/trivy/pull/10718\nhttps://github.com/aquasecurity/trivy/commit/441251e51ae46cbcf7f436547e0a5766b25328b4\nhttps://github.com/aquasecurity/trivy\nhttps://github.com/aquasecurity/trivy/releases/tag/v0.71.0\n","enisa_id":"EUVD-2026-39479\n","aliases":"CVE-2026-54448\nGHSA-q3fv-x8vg-qqm4\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8e6fa80d-0583-3d4b-ad09-17e85814cc3d","vulnerability":{"id":"CVE-2026-54448","description":"Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.","datePublished":"Jun 25, 2026, 4:27:33 PM","dateUpdated":"Jun 25, 2026, 6:55:50 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4\nhttps://github.com/aquasecurity/trivy/pull/10718\n","enisa_id":"EUVD-2026-39479\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Nov 5, 2026, 7:16:53 AM","vulnerabilityProduct":[{"id":"d9a416f5-31b2-3b6f-80a9-8aa5c5eb442f","product":{"name":"trivy","vendor":{"name":"aquasecurity"}},"product_version":"\u003c 0.71.0"}],"vulnerabilityVendor":[{"id":"e4064483-5ec9-30ba-bd30-d4a6150ecdf2","vendor":{"name":"aquasecurity"}}]}}],"enisaIdAdvisory":[{"id":"4fa81fba-e01e-3394-9242-45b834fd3987","advisory":{"id":"openSUSE-SU-2026:11162-1","description":"trivy-0.71.2-2.1 on GA media","summary":"trivy-0.71.2-2.1 on GA media","datePublished":"Jun 30, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:12:18 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11162-1.json\nhttps://www.suse.com/security/cve/CVE-2026-54448/\nhttps://www.suse.com/security/cve/CVE-2026-55092/\n","aliases":"CVE-2026-54448\nCVE-2026-55092\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"227e1c3b-4e37-3db0-a229-66bcee5f50b4","product":{"name":"trivy-0:0.71.2-2.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6d6bac69-2f8a-33f9-af17-dafec19794c1","product":{"name":"trivy-0:0.71.2-2.1.s390x","vendor":{"name":"SUSE"}}},{"id":"7d7a6ea5-7599-30ee-96e8-d709322cce0e","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"a01804d0-89ba-3670-9532-dd9a4ed075c5","product":{"name":"trivy-0:0.71.2-2.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c97b03ef-5b48-3d77-a4e1-e60915ca0bc4","product":{"name":"trivy-0:0.71.2-2.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"9f4674a2-77ab-3eb7-9e71-21fa7cd4fa41","advisory":{"id":"openSUSE-SU-2026:21249-1","description":"Security update for trivy","summary":"Security update for trivy","datePublished":"Jul 7, 2026, 4:21:44 PM","dateUpdated":"Sep 17, 2026, 5:37:59 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21249-1.json\nhttps://bugzilla.suse.com/1269269\nhttps://bugzilla.suse.com/1269271\nhttps://www.suse.com/security/cve/CVE-2026-54448/\nhttps://www.suse.com/security/cve/CVE-2026-55092/\n","aliases":"CVE-2026-54448\nCVE-2026-55092\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1059adfc-3709-3f92-aa95-0bdd88f8a199","product":{"name":"trivy-0:0.72.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"34c20177-6439-33a3-ba78-042b12e71dce","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"45fd4340-c9a6-38ba-9609-4922466ad597","product":{"name":"trivy-0:0.72.0-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"4fa67dd8-2f00-3cfb-b882-e2213390c844","product":{"name":"trivy-0:0.72.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7730814b-51c4-3dde-a064-5d9a34265914","product":{"name":"trivy-0.72.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"86e8c293-5ee1-3196-aecb-e8e22006fd65","product":{"name":"trivy-0.72.0-160000.1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a234a0f9-d9b0-3bc5-8c96-7a55e9217252","product":{"name":"trivy-0:0.72.0-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"bea64af5-b5d6-3867-88f1-bff76dcfaad8","product":{"name":"trivy-0.72.0-160000.1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"e501adf5-5fd2-3fae-890a-197b30dbb768","product":{"name":"trivy-0.72.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}}]}