CVE-2026-54448CWE-770CWE-789

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Medium · published June 25, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
37.5
In the wild
Unconfirmed
What it is

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00443 · 37.5th percentile
Weaknesses
CWE-770 · Allocation of Resources Without Limits or Throttling; CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-06-25T16:27Z
EPSS history
Timeline
  • 25 JUN 16:27Z
    Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
    cvelistv5