CVE-2026-54448

High

Advisory

Published 14 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 37th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 17; of 17,781 indexed, latest versions
Container images: 19; deployed by those charts
Fix available: 1 of 1; affected package

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 19 images.

Affected package	Affected versions	Fixed in	Images
github.com/aquasecurity/trivygolang	v0.29.2, v0.32.0, v0.37.1, v0.43.1+11 more	0.71.0	19

OSV records: GHSA-q3fv-x8vg-qqm4
Also known as: GO-2026-5983

Charts affected

17 by stars

Chart

Latest

Affected images

Radar Score

artifact-hubartifact-hub

1.23.0

2 of 7 See more

artifact-hub artifact-hub 1.23.0

2 of the 7 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.69.3	bcc376de8d77	github.com/aquasecurity/trivy@v0.69.3	0.71.0
artifacthub/scanner :v1.23.0	2d8365601f0e	github.com/aquasecurity/trivy@v0.69.3	0.71.0

Open the chart page →

10,755

helm-dashboardbeluga-cloud

2.4.0

1 of 1 See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard :1.3.3	9ab9a675c405	github.com/aquasecurity/trivy@v0.46.0	0.71.0

Open the chart page →

2,898

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	github.com/aquasecurity/trivy@v0.37.1	0.71.0

Open the chart page →

5,598

dockyarddockyard

0.4.0

1 of 1 See more

dockyard dockyard 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
ghcr.io/kgma74/dockyard :0.4.0	b40439329191	github.com/aquasecurity/trivy@v0.56.2	0.71.0

Open the chart page →

1,542

artifact-hubsoftonic

1.19.0

4 of 8 See more

artifact-hub softonic 1.19.0

4 of the 8 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.43.1	944a04445179	github.com/aquasecurity/trivy@v0.43.1	0.71.0
artifacthub/hub :v1.19.0	111918d8c399	github.com/aquasecurity/trivy@v0.52.2	0.71.0
artifacthub/scanner :v1.19.0	323d026e78c3	github.com/aquasecurity/trivy@v0.50.1	0.71.0
artifacthub/tracker :v1.19.0	6596c8c4d955	github.com/aquasecurity/trivy@v0.52.2	0.71.0

Open the chart page →

14,491

devtron-enterprisedevtron

48.0.0

1 of 28 See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	github.com/aquasecurity/trivy@v0.46.1	0.71.0

Open the chart page →

68,240

devtron-enterprisedevtron-labs

48.0.0

1 of 28 See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	github.com/aquasecurity/trivy@v0.46.1	0.71.0

Open the chart page →

68,240

harborgpg-dev

1.18.3

1 of 8 See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
goharbor/trivy-adapter-photon :v2.14.3	5c6f7162804c	github.com/aquasecurity/trivy@v0.69.3	0.71.0

Open the chart page →

3,376

deploydefenderk8s-custom-controller

0.1.3

1 of 1 See more

deploydefender k8s-custom-controller 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
ghcr.io/manzil-infinity180/deploydefender :ea3ab0bb646cdbeddd1aca483ecf650f9ac0d084	7fbc6855c8b3	github.com/aquasecurity/trivy@v0.55.2	0.71.0

Open the chart page →

1,893

harborkubesphere

1.9.3

1 of 11 See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
goharbor/trivy-adapter-photon :v2.5.3	b9522c3f5056	github.com/aquasecurity/trivy@v0.29.2	0.71.0

Open the chart page →

17,798

trivy-serverlemontech

0.1.0

1 of 1 See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.32.0	973d0df16189	github.com/aquasecurity/trivy@v0.32.0	0.71.0

Open the chart page →

4,271

m9sweeperm9sweeper

1.6.0

1 of 6 See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
ghcr.io/m9sweeper/trawler :1.6.0	df917c5a7e54	github.com/aquasecurity/trivy@v0.48.3	0.71.0

Open the chart page →

9,774

devtron-enterpriseromholdings

48.0.0

1 of 28 See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	github.com/aquasecurity/trivy@v0.46.1	0.71.0

Open the chart page →

68,240

harborsoftonic

1.13.0

1 of 8 See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
goharbor/trivy-adapter-photon :v2.9.0	dc5b882a7db4	github.com/aquasecurity/trivy@v0.44.0	0.71.0

Open the chart page →

7,672

trivy-operatorsoftonic

0.18.0

1 of 1 See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
ghcr.io/aquasecurity/trivy-operator :0.16.0	a608b798fda5	github.com/aquasecurity/trivy@v0.44.1	0.71.0

Open the chart page →

2,505

harbor-scanner-trivytrivy-operator

0.31.2

1 of 1 See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	github.com/aquasecurity/trivy@v0.51.2	0.71.0

Open the chart page →

2,477

trivy-webhook-aws-security-hubtrivy-webhook-aws-security-hub

0.1.20

1 of 1 See more

trivy-webhook-aws-security-hub trivy-webhook-aws-security-hub 0.1.20

1 of the 1 container images this version deploys carry CVE-2026-54448.

Container image	Digest	Package	Fixed in
ghcr.io/csepulveda/trivy-webhook-aws-security-hub :v0.1.20	6836b779b060	github.com/aquasecurity/trivy@v0.69.3	0.71.0

Open the chart page →

616

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	github.com/aquasecurity/trivy@v0.46.1	0.71.0	3
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	github.com/aquasecurity/trivy@v0.51.2	0.71.0	1
aquasec/trivy :0.43.1	944a04445179	github.com/aquasecurity/trivy@v0.43.1	0.71.0	1
aquasec/trivy :0.32.0	973d0df16189	github.com/aquasecurity/trivy@v0.32.0	0.71.0	1
aquasec/trivy :0.69.3	bcc376de8d77	github.com/aquasecurity/trivy@v0.69.3	0.71.0	1
artifacthub/hub :v1.19.0	111918d8c399	github.com/aquasecurity/trivy@v0.52.2	0.71.0	1
artifacthub/scanner :v1.23.0	2d8365601f0e	github.com/aquasecurity/trivy@v0.69.3	0.71.0	1
artifacthub/scanner :v1.19.0	323d026e78c3	github.com/aquasecurity/trivy@v0.50.1	0.71.0	1
artifacthub/tracker :v1.19.0	6596c8c4d955	github.com/aquasecurity/trivy@v0.52.2	0.71.0	1
devopstales/trivy-operator :2.5	75136aa7a26e	github.com/aquasecurity/trivy@v0.37.1	0.71.0	1
goharbor/trivy-adapter-photon :v2.14.3	5c6f7162804c	github.com/aquasecurity/trivy@v0.69.3	0.71.0	1
goharbor/trivy-adapter-photon :v2.5.3	b9522c3f5056	github.com/aquasecurity/trivy@v0.29.2	0.71.0	1
goharbor/trivy-adapter-photon :v2.9.0	dc5b882a7db4	github.com/aquasecurity/trivy@v0.44.0	0.71.0	1
ghcr.io/aquasecurity/trivy-operator :0.16.0	a608b798fda5	github.com/aquasecurity/trivy@v0.44.1	0.71.0	1
ghcr.io/beluga-cloud/helm-dashboard/dashboard :1.3.3	9ab9a675c405	github.com/aquasecurity/trivy@v0.46.0	0.71.0	1
ghcr.io/csepulveda/trivy-webhook-aws-security-hub :v0.1.20	6836b779b060	github.com/aquasecurity/trivy@v0.69.3	0.71.0	1
ghcr.io/kgma74/dockyard :0.4.0	b40439329191	github.com/aquasecurity/trivy@v0.56.2	0.71.0	1
ghcr.io/m9sweeper/trawler :1.6.0	df917c5a7e54	github.com/aquasecurity/trivy@v0.48.3	0.71.0	1
ghcr.io/manzil-infinity180/deploydefender :ea3ab0bb646cdbeddd1aca483ecf650f9ac0d084	7fbc6855c8b3	github.com/aquasecurity/trivy@v0.55.2	0.71.0	1