Most recent entries from all

bdu:2026-15349

2026-10-09T18:04:27.921056+00:00

bdu:2026-15349

EUVD-2026-330383

2026-10-09T18:04:27.921095+00:00

EUVD-2026-330383

fkie_cve-2026-54448

2026-10-09T18:04:27.921109+00:00

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

GHSA-q3fv-x8vg-qqm4 — Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

2026-10-09T18:04:27.921147+00:00

Affected: Go: github.com/aquasecurity/trivy

## Summary

When Trivy scans a Helm chart archive (`.tgz`), its custom tar unpacker reads each entry with `io.ReadAll(tr)` and no size limit. An attacker who can place a malicious `.tgz` file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer.

## Affected configurations

Exploitation requires the attacker to place a crafted `.tgz` file in a location that Trivy will scan as a Helm chart. This applies to the following scan targets:

| Command | Condition | | --- | --- | | `trivy config

` | Directory contains a crafted `.tgz` Helm chart (misconfiguration scanning is always enabled) | | `trivy filesystem --scanners misconf ` | Directory contains a crafted `.tgz` Helm chart **and** `--scanners misconf` is explicitly enabled | | `trivy image --scanners misconf ` | Image contains a crafted `.tgz` Helm chart **and** `--scanners misconf` is explicitly enabled |

Realistic scenarios include: - A CI pipeline that runs `trivy config .` on a repository where a contributor can submit a pull request containing a crafted chart archive. - A pipeline that scans a container image with `--scanners misconf`, whose build context includes untrusted `.tgz` files.

## Impact

An attacker who satisfies the conditions above can exhaust all available memory on the host running Trivy. The OS OOM killer will terminate the Trivy process and may affect other processes sharing the same host or…

openSUSE-SU-2026:11162-1 — trivy-0.71.2-2.1 on GA media

2026-10-09T18:04:27.921230+00:00

trivy-0.71.2-2.1 on GA media

WID-SEC-W-2026-2082 — Aqua Security Trivy: Schwachstelle ermöglicht Denial of Service

2026-10-09T18:04:27.921249+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Aqua Security Trivy ausnutzen, um einen Denial of Service Angriff durchzuführen.