CVE-2026-54448: aquasec trivy
Vulnerability summary
CVE-2026-54448 is a medium (CVSS 6.9) vulnerability in aquasec trivy. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 25-06-2026PublishedVulnerability first disclosed.
- 25-06-2026Last modifiedVulnerability information updated.
Description
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Affected systems
Chainguard17 products
- cloudbeat-8.17All versions (No fix recorded)
- cloudbeat-8.19< 8.19.18-r2
- cloudbeat-9.0All versions (No fix recorded)
- cloudbeat-9.1All versions (No fix recorded)
- cloudbeat-9.2< 9.2.8-r20
Wolfi2 products
- kubescapeAll versions (No fix recorded)
- trivy-operator< 0.30.1-r26
Aquasec1 product
- trivy< 0.71.0
Aquasecurity1 product
- trivy< 0.71.0
Github.com/aquasecurity1 product
- trivy< 0.71.0
5 vendors · 22 products
References
7 links- github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4X Refsource CONFIRMAdvisoryWEBThird Party Advisory
