Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Trivy, Helm Chart Tar Bomb Denial-of-Service, #CVE-2026-54448 (Medium) -DC-Jul2026-990 https://dailycve.com/trivy-helm-chart-tar-bomb-denial-of-service-cve-2026-54448-medium-dc-jul2026-990/
Post summary
The brief post announces Trivy’s identification of a Helm Chart tar‑bomb denial‑of‑service vulnerability (CVE‑2026‑54448) with medium severity, but no PoC, exploit, or fix details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | aquasec | trivy | - | go | - |