CVE-2026-54448 Details

A denial-of-service vulnerability has been identified in Trivy, a security scanner, prior to version 0.71.0. When Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry without a size limit. This allows an attacker to place a malicious .tgz file in the scanned path, creating a small compressed archive that expands to gigabytes. The resulting memory exhaustion causes the Trivy process to be terminated by the operating system's Out-Of-Memory (OOM) killer. The vulnerability arises from unbounded input handling in the tar parser, which can be exploited by crafting specific Helm chart archives.

Users are advised to upgrade to Trivy version 0.71.0 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, consider setting a memory limit on the Trivy process, using the '--skip-dirs' option to exclude directories with untrusted Helm charts, or avoiding scans of repositories or images that contain untrusted .tgz files.