Suse CVE-2026-33481

This vulnerability presents a moderate real-world risk with low exploitability complexity but significant operational impact. The CVSS 3.1 base score of 5.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L correctly reflects the availability impact (denial of service to the system's temporary storage) accessible over the network with no authentication required. The attack complexity is low, as demonstrated by the vulnerability being readily reproducible using large or highly compressed archives (such as zip bombs), making exploitation trivial for any user who can control input to Syft. However, the real-world EPSS score is not disclosed in the provided intelligence; the lack of active exploitation reports (no KEV status provided) and the straightforward nature of the fix suggest this is not currently a high-priority target. The impact is primarily operational (temporary storage exhaustion affecting system availability) rather than confidentiality or integrity compromise, limiting the severity in confidentiality-focused threat models. Organizations running Syft in production environments with untrusted input or in resource-constrained environments should prioritize patching, while those with proper input validation and disk monitoring may tolerate a brief delay.

An attacker could craft a malicious zip bomb or other highly compressed archive containing nested layers of compressed data. When a victim submits this archive to a Syft scanning service or runs Syft locally against the archive, Syft begins unpacking the contents into temporary storage. As the unpacking proceeds, the temporary storage becomes exhausted, Syft raises an out-of-disk exception and exits without executing its cleanup routines. The temporary files remain on disk, consuming the allocated temporary storage space and preventing other system processes (including subsequent Syft runs) from accessing temporary storage, effectively causing a denial of service. This is trivially repeatable and requires no privilege escalation or social engineering—the attacker merely needs the ability to control or influence the archive supplied to Syft.