CLEANSTART-2026-RR89078 Security fixes in harbor-scanner-trivy 0.35.1-r0

Package harbor-scanner-trivy version 0.35.1-r0 fixes 3 vulnerabilities: CVE-2025-54410, CVE-2025-15558, CVE-2025-29923...

CLEANSTART-2026-QI00029 Security fixes in harbor-scanner-trivy-fips 0.35.1-r0

Package harbor-scanner-trivy-fips version 0.35.1-r0 fixes 3 vulnerabilities: CVE-2025-54410, CVE-2025-15558, CVE-2025-29923...

GO-2026-5983 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy...

Security update for trivy (important)

openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0263-1 Rating: important References: 1266495 1268356 1269269 1269271 1271658 1271670 Cross-References: CVE-2026-39821 CVE-2026-46680 CVE-2026-50151 CVE-2026-54448 CVE-2026-55092 CVE-2026-56852 CVSS scores:...

openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21395-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21395-1 advisory. This update for trivy fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels...

Security update for trivy (important)

openSUSE security update: security update for trivy ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21395-1 Rating: important References: bsc1266495 bsc1271658 bsc1271670 Cross-References: CVE-2026-39821 CVE-2026-50151 CVE-2026-56852 CVSS scores:...

CLEANSTART-2026-LZ81863 Security fixes for CVE-2025-29923, CVE-2026-34040, CVE-2026-39822, CVE-2026-49834, CVE-2026-49835, CVE-2026-50151 applied in versions: 0.36.0-r0, 0.36.0-r1

Multiple security vulnerabilities affect the harbor-trivy-adapter-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

OPENSUSE-SU-2026:11302-1 trivy-0.72.0-2.1 on GA media

These are all security issues fixed in the trivy-0.72.0-2.1 package on the GA media of openSUSE Tumbleweed...

Uncontrolled Resource Consumption

github.com/aquasecurity/trivy is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the custom tar unpacker reading Helm chart archive .tgz entries using io.ReadAll without enforcing a size limit, which allows an attacker to supply a malicious compressed archive that...

CVE-2026-54448 vulnerabilities

Vulnerabilities for packages: trivy-operator...

GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: trivy-operator...

GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: trivy-operator, cloudbeat, cloudbeat-fips, trivy-operator-fips...

CVE-2026-54448 vulnerabilities

Vulnerabilities for packages: trivy-operator, cloudbeat, cloudbeat-fips, trivy-operator-fips...

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Summary When Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to b...

EUVD-2026-39479

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser...

GHSA-Q3FV-X8VG-QQM4 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Summary When Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to b...

PT-2026-60978

Name of the Vulnerable Software and Affected Versions trivy versions prior to 0.72.0-2.1 Description A norm.Iter can enter an infinite loop when processing input that contains invalid UTF-8 bytes. UTF-8 is a character encoding capable of encoding all possible Unicode characters. Recommendations...

GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities

Vulnerabilities for packages: aactl, teleport, kyverno-fips, trivy-fips, spire-server-fips, trivy-operator-fips, policy-controller, falcoctl, ratify-fips, kyverno, policy-controller-fips, gitsign, kyverno-notation-aws-fips, neuvector-sigstore-interface, teleport-operator-fips, tekton-chains-fips,...

CVE-2026-49834 vulnerabilities

Vulnerabilities for packages: aactl, teleport, kyverno-fips, trivy-fips, spire-server-fips, trivy-operator-fips, policy-controller, falcoctl, ratify-fips, kyverno, policy-controller-fips, gitsign, kyverno-notation-aws-fips, neuvector-sigstore-interface, teleport-operator-fips, tekton-chains-fips,...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: kubevirt-cdi-uploadserver, crossplane-provider-aws-devicefarm, nri-postgresql, timoni, kubevirt-cdi-controller-fips, rook-fips, crossplane-provider-aws-cloudsearch-fips, crossplane-provider-aws-docdb, sap-btp-service-operator-fips, otel-cli, grafana-pyroscope,...