CVE-2026-54448: Trivy Helm Chart Denial-of-Service – Zip Bomb Vulnerability

Technical summary

Trivy's custom tar unpacker reads tar entries directly using io.ReadAll(tr) without implementing size constraints or decompression ratio checks. An attacker can craft a highly-compressed .tgz archive (zip bomb pattern) that decompresses to an enormous size, exhausting heap memory and triggering OOM termination. The vulnerability is rooted in CWE-770 (Allocation of Resources Without Limits) and CWE-789 (Memory Allocation with Excessive Size Value). Authentication is required only in the sense that the attacker must place the malicious file in a location Trivy will scan—no direct interaction with Trivy's network interface is needed. The CVSS 3.1 score of 6.5 reflects the availability impact and low attack complexity.

Business impact

Organizations relying on Trivy for continuous security scanning in CI/CD pipelines or registry monitoring may experience scanner unavailability and delayed security assessments. If Trivy runs as a service or in a shared container orchestration environment, the OOM condition can affect neighboring workloads. Repeated attacks could degrade supply chain security posture by preventing timely vulnerability detection. The impact is primarily operational availability rather than data breach risk.

Affected systems

Trivy versions prior to 0.71.0 are vulnerable. This includes all instances scanning Helm charts in environments where untrusted or attacker-controlled .tgz files may be present—typical in registry scanning, artifact scanning, or open-source dependency analysis workflows. Users who exclusively scan container images (not Helm charts) have a reduced attack surface but are still running vulnerable code.

Exploitability

Exploitation requires an attacker to place a malicious .tgz file in a location that Trivy will scan. This is feasible in scenarios where Trivy scans third-party Helm repositories, user-submitted artifacts, or supply chain artifacts from less-trusted sources. Attack complexity is low once file placement is possible. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date, though the technique is straightforward and no authentication to Trivy itself is required.

Remediation

Update Trivy to version 0.71.0 or later, which implements size limits in its tar unpacker. Organizations should prioritize this update in environments where Trivy scans untrusted or external Helm charts. Interim mitigation may include restricting Trivy's execution in sandboxed or resource-limited containers with aggressive OOM kill policies, though this does not address the root cause.

Patch guidance

Verify your Trivy installation version using `trivy version`. Upgrade to 0.71.0 or later via your package manager or by downloading the latest release from the official Aqua Security repository. Test the upgrade in a non-production environment first to ensure compatibility with your scanning workflows. Container users should pull the latest Trivy image tag (verify it corresponds to 0.71.0+) and redeploy.

Detection guidance

Monitor for Trivy process crashes or OOM events in logs and container orchestration platforms. Implement memory limits and alerts on Trivy pods or processes to catch abnormal resource consumption. Review scan job logs for unexpected terminations during Helm chart processing. In registry or artifact storage systems, audit for unusual .tgz file uploads that precede Trivy failures. Network-based detection is not applicable since the attack relies on file placement rather than network exploitation.

Why prioritize this

Although the CVSS score is moderate (6.5 MEDIUM), the vulnerability affects a critical security tool and is easily exploitable in supply-chain and multi-tenant scanning scenarios. Prioritize patching if Trivy scans external or untrusted Helm repositories or if it runs in shared infrastructure. Organizations scanning only internal, trusted artifacts have lower risk but should still update within standard maintenance windows.

Risk score, explained

CVSS 3.1 6.5 reflects a high availability impact (AV:N/AC:L/A:H) balanced against the requirement for the attacker to place a file in Trivy's scan path (PR:L contextually, as the attacker must have some ability to influence scanned content). No confidentiality or integrity impact occurs. The score appropriately captures a denial-of-service threat to a critical tool without inflating for speculative downstream effects.

Frequently asked questions