EUVD-2026-39479
GHSA-q3fv-x8vg-qqm4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery of crafted archive, no attacker privileges needed, but operator must trigger the scan (UI:R); impact is availability-only, scope unchanged.
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.
AnalysisAI
Decompression bomb (zip bomb) in Trivy's Helm chart scanner causes denial of service via OOM kill when processing a crafted .tgz archive. Affected versions prior to 0.71.0 use io.ReadAll without any size cap on tar entries inside Helm chart archives, allowing a small compressed file to expand to gigabytes in memory. An attacker who can place a malicious archive in any path that Trivy is directed to scan can reliably crash the Trivy process. No public exploit or CISA KEV listing at time of analysis.
Technical ContextAI
Trivy (cpe:2.3:a:aquasecurity:trivy:*:*:*:*:*:*:*:*) is an open-source vulnerability and misconfiguration scanner widely used in CI/CD pipelines and DevSecOps workflows. The vulnerable code path resides in pkg/iac/scanners/helm/parser/parser.go, where the custom tar unpacker invoked io.ReadAll(tr) on each archive entry with no size bound - a classic CWE-770 (Allocation of Resources Without Limits or Throttling) pattern. The .tgz format's high compression ratio means a few-kilobyte payload can decompress into multi-gigabyte allocations, triggering Linux OOM killer termination of the Trivy process. The fix in 0.71.0 (PR #10718) replaces the custom unbounded unpacking logic with the official helm.sh/helm/v4 chart utilities and introduces a dedicated ParseArchive function, eliminating the direct io.ReadAll path.
RemediationAI
Upgrade Trivy to version 0.71.0 or later, which replaces the unbounded io.ReadAll tar unpacking with safe Helm library routines (vendor-released patch confirmed at https://github.com/aquasecurity/trivy/pull/10718 and https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4). If immediate upgrade is not possible, restrict the file paths Trivy is permitted to scan so that untrusted or externally-supplied .tgz archives are excluded - this prevents the vulnerable code path from being triggered but limits scanning coverage. In CI/CD contexts, sanitize or quarantine third-party Helm chart archives before passing them to Trivy. Note that disabling Helm chart scanning entirely is a viable workaround with the trade-off of reduced IaC misconfiguration coverage.
Trivy security scanner v0.69.4 was compromised in a supply chain attack where a threat actor used stolen credentials to
Arbitrary file write in Aqua Security's Trivy scanner (prior to 0.71.1) allows an attacker who can make Trivy fetch an a
Arbitrary file write in Trivy's plugin manager prior to version 0.72.0 allows a malicious plugin author to escape the co
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today