PT-2026-60918

Name of the Vulnerable Software and Affected Versions Trivy versions prior to 0.72.0 Description A path traversal flaw exists in the plugin manager where plugin manifest metadata is used to construct paths under /.trivy/plugins without properly confining plugin names to that root. An attacker can...

OPENSUSE-SU-2026:11302-1 trivy-0.72.0-2.1 on GA media

These are all security issues fixed in the trivy-0.72.0-2.1 package on the GA media of openSUSE Tumbleweed...

Uncontrolled Resource Consumption

github.com/aquasecurity/trivy is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the custom tar unpacker reading Helm chart archive .tgz entries using io.ReadAll without enforcing a size limit, which allows an attacker to supply a malicious compressed archive that...

CVE-2026-54448 vulnerabilities

Vulnerabilities for packages: trivy-operator...

GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: trivy-operator...

GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: cloudbeat, trivy-operator-fips, cloudbeat-fips, trivy-operator...

CVE-2026-54448 vulnerabilities

Vulnerabilities for packages: cloudbeat, trivy-operator-fips, cloudbeat-fips, trivy-operator...

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Summary When Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to b...

EUVD-2026-39479

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser...

GHSA-Q3FV-X8VG-QQM4 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Summary When Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to b...

PT-2026-60978

Name of the Vulnerable Software and Affected Versions trivy versions prior to 0.72.0-2.1 Description A norm.Iter can enter an infinite loop when processing input that contains invalid UTF-8 bytes. UTF-8 is a character encoding capable of encoding all possible Unicode characters. Recommendations...

CVE-2026-49834 vulnerabilities

Vulnerabilities for packages: trivy, cloudbeat-fips, image-factory-fips, kubescape-server-fips, kyverno-fips, gitsign, image-factory, aactl, neuvector-sigstore-interface-fips, trivy-fips, zarf-fips, tekton-chains-fips, teleport, cloudbeat, neuvector-sigstore-interface, zarf, tflint-fips,...

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: trivy, cloudbeat-fips, image-factory-fips, kubescape-server-fips, kyverno-fips, gitsign, image-factory, aactl, neuvector-sigstore-interface-fips, trivy-fips, zarf-fips, tekton-chains-fips, teleport, cloudbeat, neuvector-sigstore-interface, zarf, tflint-fips,...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: argocd-image-updater, dockerize-fips, minio-object-browser-fips, envconsul-fips, karma, coredns-fips, crossplane-provider-aws-codecommit-fips, crossplane-provider-aws-mediaconvert-fips, gitleaks-fips, ko, chainloop-control-plane-fips,...

vuln-chain-3-4-14-demo

vuln-chain-spring-boot — a Trivy "green but owned" demo An in...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21249-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21249-1 advisory. This update for trivy fixes the following issues Update to version 0.72.0. - CVE-2026-54448: tar unpacker reads scanned Helm chart archives .tgz...

Security update for trivy (important)

openSUSE security update: security update for trivy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21249-1 Rating: important References: bsc1269269 bsc1269271 Cross-References: CVE-2026-54448 CVE-2026-55092 CVSS scores: CVE-2026-54448 SUSE : 6.5...

OPENSUSE-SU-2026:21249-1 Security update for trivy

This update for trivy fixes the following issues Update to version 0.72.0. - CVE-2026-54448: tar unpacker reads scanned Helm chart archives .tgz with io.ReadAlltr and defines no size limit, which can lead to a DoS bsc1269271. - CVE-2026-55092: org.opencontainers.image.title annotation from OCI...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: trivy: trivy-0.72.0-0.1.hum1 aarch64, x8664 trivy-0.72.0-0.1.hum1.src src Security Fixes: trivy: CVE-2026-46680 CVE-2026-47262 CVE-2026-53488...

trivy-0.71.2-2.1 on GA media (moderate)

trivy-0.71.2-2.1 on GA media Announcement ID: openSUSE-SU-2026:11162-1 Rating: moderate Cross-References: CVE-2026-54448 CVE-2026-55092 CVSS scores: CVE-2026-54448 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2026-54448 SUSE : 6.9...