{"id":"GO-2026-5983","summary":"Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy","details":"Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy","aliases":["CVE-2026-54448","GHSA-q3fv-x8vg-qqm4"],"modified":"2026-07-28T15:15:01.389987401Z","published":"2026-07-27T15:30:50Z","related":["CGA-jhj3-7g6v-m4m6"],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-5983","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4"},{"type":"FIX","url":"https://github.com/aquasecurity/trivy/commit/441251e51ae46cbcf7f436547e0a5766b25328b4"},{"type":"FIX","url":"https://github.com/aquasecurity/trivy/pull/10718"},{"type":"WEB","url":"https://github.com/aquasecurity/trivy/releases/tag/v0.71.0"}],"affected":[{"package":{"name":"github.com/aquasecurity/trivy","ecosystem":"Go","purl":"pkg:golang/github.com/aquasecurity/trivy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.71.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/aquasecurity/trivy/pkg/iac/detection","symbols":["IsArchive"]},{"symbols":["Scanner.ScanFS"],"path":"github.com/aquasecurity/trivy/pkg/iac/scanners/helm"},{"path":"github.com/aquasecurity/trivy/pkg/iac/scanners/helm/parser","symbols":["New","Parser.ParseFS","Parser.RenderedChartFiles","Parser.unpackArchive"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-5983.json"}}],"schema_version":"1.7.5"}