CVE-2026-54448

Katalog CVE

CVSS 6.5 · Medium EPSS 0,44%

Kerentanan Allocation of Resources Without Limits or Throttling pada aquasec trivy. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling
CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aquasecurity/trivy/pull/10718 issue tracking · advisory pihak ketiga
• https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4 advisory pihak ketiga