{"schema_version":"1.3.1","id":"GO-2026-5983","modified":"2026-07-27T15:30:50Z","published":"2026-07-27T15:30:50Z","aliases":["CVE-2026-54448","GHSA-q3fv-x8vg-qqm4"],"summary":"Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy","details":"Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy","affected":[{"package":{"name":"github.com/aquasecurity/trivy","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.71.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/aquasecurity/trivy/pkg/iac/detection","symbols":["IsArchive"]},{"path":"github.com/aquasecurity/trivy/pkg/iac/scanners/helm","symbols":["Scanner.ScanFS"]},{"path":"github.com/aquasecurity/trivy/pkg/iac/scanners/helm/parser","symbols":["New","Parser.ParseFS","Parser.RenderedChartFiles","Parser.unpackArchive"]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4"},{"type":"FIX","url":"https://github.com/aquasecurity/trivy/commit/441251e51ae46cbcf7f436547e0a5766b25328b4"},{"type":"FIX","url":"https://github.com/aquasecurity/trivy/pull/10718"},{"type":"WEB","url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.0"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5983","review_status":"REVIEWED"}}