Is CVE-2026-54448 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54448 being exploited in the wild.

How severe is CVE-2026-54448?

High severity, with a CVSS score of 4, published 25 June 2026.

Which products and versions are affected?

Aqua Security Trivy < 0.71.0; github.com/aquasecurity/trivy (Go) < 0.71.0, SEMVER:introduced=0,fixed=0.71.0.

Is there a fix for CVE-2026-54448?

Yes. github.com/aquasecurity/trivy (Go): upgrade to 0.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54448 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54448?

Check whether you run Aqua Security Trivy or github.com/aquasecurity/trivy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54448: Aqua Security Trivy denial of service via Helm chart tar bomb

Q: Which products and versions are affected?

Aqua Security Trivy < 0.71.0; github.com/aquasecurity/trivy (Go) < 0.71.0, SEMVER:introduced=0,fixed=0.71.0.

Q: Is there a fix for CVE-2026-54448?

Yes. github.com/aquasecurity/trivy (Go): upgrade to 0.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54448 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54448?

Check whether you run Aqua Security Trivy or github.com/aquasecurity/trivy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54448 · Severity: high · CVSS 4 · Published 2026-06-25

Aqua Security Trivy is a security scanner used to find vulnerabilities and misconfigurations in software projects and container images. A flaw in how it handles Helm chart archives allows an attacker to provide a specially crafted file that, when scanned, consumes all available system memory. This results in a denial-of-service condition where the scanner crashes, potentially disrupting automated software delivery pipelines and incurring additional cloud infrastructure costs.

Technologies: Aqua Security Trivy, github.com/aquasecurity/trivy (Go). Vendors: Aqua Security, Go.

Quick answers

Is CVE-2026-54448 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54448 being exploited in the wild.
How severe is CVE-2026-54448?: High severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?: Aqua Security Trivy < 0.71.0; github.com/aquasecurity/trivy (Go) < 0.71.0, SEMVER:introduced=0,fixed=0.71.0.
Is there a fix for CVE-2026-54448?: Yes. github.com/aquasecurity/trivy (Go): upgrade to 0.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54448 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54448?: Check whether you run Aqua Security Trivy or github.com/aquasecurity/trivy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/aquasecurity/trivy (Go): upgrade to 0.71.0 or later
```
go get github.com/aquasecurity/trivy@v0.71.0
```

Technical details

Trivy's custom tar unpacker utilized `io.ReadAll` without size limits when processing Helm chart (`.tgz`) entries. An attacker can exploit this by placing a malicious, highly-compressed archive in a location scanned by Trivy (such as a git repository or container image build context). When Trivy attempts to parse the archive during a configuration or filesystem scan, the unbounded memory allocation causes the operating system's Out-Of-Memory (OOM) killer to terminate the process. The vulnerability was addressed in version 0.71.0 by replacing the custom unpacker with the official Helm SDK, which enforces per-entry and total size limits.

Affected products

Aqua Security Trivy < 0.71.0

Identifiers

CVE-2026-54448
GHSA-q3fv-x8vg-qqm4
GO-2026-5983

Timeline

2026-06-04: disclosed: Initial disclosure by nikpivkin
2026-06-25: advisory: NVD publication date
2026-07-14: patched: GitHub Advisory reviewed and updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.