CVE-2026-54448
Last modified
CVE-2026-54448 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Aquasec | Trivy | < 0.71.0 |
References
- https://github.com/aquasecurity/trivy/pull/10718Issue Tracking, Third Party Advisory
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4Third Party Advisory
- https://github.com/aquasecurity/trivy/pull/10718Issue Tracking, Third Party Advisory
- https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-54448?
How severe is CVE-2026-54448?
How do I fix CVE-2026-54448?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-5444A heap buffer overflow vulnerability exists in the PAM image…7.1
- CVE-2026-54443Dashy is a self-hostable personal dashboard. From 1.9.4 unti…5.9
- CVE-2026-54444Rejected reason: ]** REJECT ** DO NOT USE THIS CANDIDATE NUM…
- CVE-2026-54445vantage6 is an open-source infrastructure for privacy preser…6.9
- CVE-2026-54446NetLicensing MCP Server is a natural-language interface that…8.1
- CVE-2026-54447garminconnect is a Python 3 API wrapper for Garmin Connect t…8.4
- CVE-2026-54449LangBot is a global IM bot platform designed for LLMs. In ve…8.8
- CVE-2026-5445An out-of-bounds read vulnerability exists in the `DecodeLoo…9.1
- CVE-2026-54450ToolHive is a utility designed to simplify the deployment an…2.9
- CVE-2026-54451Elixir protobuf is a pure Elixir implementation of Google Pr…8.2
- CVE-2026-54452safeurl is a server-side request forgery protection library.…6.3
- CVE-2026-54457TensorZero is an open-source LLMOps platform that unifies an…7.7
Are you affected by CVE-2026-54448?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST