Attack Chain

1. An attacker creates a highly compressed .tgz Helm chart archive designed to decompress into an extremely large file, for example, by embedding a large number of null bytes.
2. The attacker places this crafted .tgz file in a location that a vulnerable Trivy instance is configured to scan, such as a repository that a CI pipeline runs trivy config . on, or within a container image scanned for misconfigurations.
3. A vulnerable Trivy instance (version < 0.71.0) initiates a scan that includes the path containing the malicious .tgz file, for example, via trivy config <dir>, trivy filesystem --scanners misconf <dir>, or trivy image --scanners misconf <image>.
4. Trivy's internal tar unpacker encounters the malicious .tgz file and attempts to decompress and parse it as a Helm chart.
5. Due to the unbounded io.ReadAll implementation, Trivy attempts to read the entire decompressed (gigabytes-large) archive entry into memory without any size limits.
6. The Trivy process rapidly consumes all available memory on the host system or CI runner where it is executing, leading to severe memory pressure.
7. The operating system's Out-Of-Memory (OOM) killer is triggered in response to the memory exhaustion.
8. The OOM killer forcibly terminates the Trivy process and potentially other processes sharing the same host, resulting in a denial of service (DoS) for the scanning operation and potential disruption to the CI pipeline or affected system.

Impact

An attacker exploiting CVE-2026-54448 can cause a denial of service by exhausting all available memory on the host running the vulnerable Trivy process. This triggers the operating system's OOM killer, which terminates the Trivy process and may also affect other processes sharing the same host or CI runner. In CI/CD environments, the practical impact is that security scans fail, pipelines are blocked, and repeated submissions of malicious archives continue to disrupt operations. Cloud CI runners may also incur additional costs due to prolonged resource consumption attempts. There is no observed impact on the confidentiality or integrity of the scanned system itself, only its availability.

Recommendation

• Upgrade Trivy to version v0.71.0 or later immediately to patch CVE-2026-54448. The fix replaces the vulnerable custom tar unpacker with the official Helm SDK which includes size limits.
• If immediate upgrade is not possible, set memory limits (e.g., via cgroups or container runtime configurations) on the Trivy process to bound the blast radius of memory exhaustion.
• Use the --skip-dirs flag to exclude directories containing untrusted Helm chart archives (.tgz files) from Trivy scans.
• Avoid scanning repositories or container images that are known to contain untrusted .tgz files when using vulnerable versions of Trivy.