{"schema_version":"1.7.5","id":"GO-2026-5983","published":"2026-07-27T15:30:50Z","modified":"2026-07-28T15:15:01.389987401Z","aliases":["CVE-2026-54448","GHSA-q3fv-x8vg-qqm4"],"related":["CGA-jhj3-7g6v-m4m6"],"summary":"Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy","details":"Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy","affected":[{"package":{"name":"github.com/aquasecurity/trivy","ecosystem":"Go","purl":"pkg:golang/github.com/aquasecurity/trivy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.71.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/aquasecurity/trivy/pkg/iac/detection","symbols":["IsArchive"]},{"path":"github.com/aquasecurity/trivy/pkg/iac/scanners/helm","symbols":["Scanner.ScanFS"]},{"path":"github.com/aquasecurity/trivy/pkg/iac/scanners/helm/parser","symbols":["New","Parser.ParseFS","Parser.RenderedChartFiles","Parser.unpackArchive"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5983.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4"},{"type":"FIX","url":"https://github.com/aquasecurity/trivy/commit/441251e51ae46cbcf7f436547e0a5766b25328b4"},{"type":"FIX","url":"https://github.com/aquasecurity/trivy/pull/10718"},{"type":"WEB","url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.0"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-5983"}}