Vulnerability-Lookup

RHSA-2026:72492

Vulnerability from csaf_redhat - Published: 2026-09-28 12:58 - Updated: 2026-10-09 04:13

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: trivy: * trivy-0.74.0-0.4.hum1 (aarch64, x86_64) * trivy-0.74.0-0.4.hum1.src (src) Security Fix(es): trivy: * CVE-2026-93450

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-63209

A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads to out-of-bounds memory access, crashing the application and resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-823 - Use of Out-of-range Pointer Offset

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-104994

A flaw was found in Trivy. This vulnerability allows information disclosure when scanning untrusted Terraform configuration files for misconfigurations. An attacker can craft a configuration that uses filesystem functions to reference pathnames outside the designated scan root directory. This directory traversal enables Trivy to read unauthorized files on the host system and potentially expose sensitive data within the scan output.

2.5 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 3 products, the same list as for CVE-2026-63209

Threats

Impact Low

References

22 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:72492	self
https://access.redhat.com/security/cve/CVE-2026-93450	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-63209	external
https://access.redhat.com/security/cve/CVE-2026-104994	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-63209	self
https://bugzilla.redhat.com/show_bug.cgi?id=2543236	external
https://www.cve.org/CVERecord?id=CVE-2026-63209	external
https://nvd.nist.gov/vuln/detail/CVE-2026-63209	external
https://github.com/klauspost/compress/commit/5392…	external
https://github.com/klauspost/compress/releases/ta…	external
https://github.com/klauspost/compress/security/ad…	external
https://access.redhat.com/security/cve/CVE-2026-104994	self
https://bugzilla.redhat.com/show_bug.cgi?id=2545329	external
https://www.cve.org/CVERecord?id=CVE-2026-104994	external
https://nvd.nist.gov/vuln/detail/CVE-2026-104994	external
https://github.com/aquasecurity/trivy/blob/main/C…	external
https://github.com/aquasecurity/trivy/commit/9d91…	external
https://github.com/aquasecurity/trivy/pull/10664	external
https://github.com/aquasecurity/trivy/security/ad…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ntrivy:\n  * trivy-0.74.0-0.4.hum1 (aarch64, x86_64)\n  * trivy-0.74.0-0.4.hum1.src (src)\n\nSecurity Fix(es):\n\ntrivy:\n  * CVE-2026-93450",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:72492",
        "url": "https://access.redhat.com/errata/RHSA-2026:72492"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-93450",
        "url": "https://access.redhat.com/security/cve/CVE-2026-93450"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-63209",
        "url": "https://access.redhat.com/security/cve/CVE-2026-63209"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-104994",
        "url": "https://access.redhat.com/security/cve/CVE-2026-104994"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72492.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-10-09T04:13:35+00:00",
      "generator": {
        "date": "2026-10-09T04:13:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:72492",
      "initial_release_date": "2026-09-28T12:58:53+00:00",
      "revision_history": [
        {
          "date": "2026-09-28T12:58:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-02T21:09:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-09T04:13:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.74.0-0.4.hum1@aarch64",
                "product": {
                  "name": "trivy-0:0.74.0-0.4.hum1@aarch64",
                  "product_id": "trivy-0:0.74.0-0.4.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/trivy@0.74.0-0.4.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.74.0-0.4.hum1@src",
                "product": {
                  "name": "trivy-0:0.74.0-0.4.hum1@src",
                  "product_id": "trivy-0:0.74.0-0.4.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/trivy@0.74.0-0.4.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "trivy-0:0.74.0-0.4.hum1@x86_64",
                "product": {
                  "name": "trivy-0:0.74.0-0.4.hum1@x86_64",
                  "product_id": "trivy-0:0.74.0-0.4.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/trivy@0.74.0-0.4.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.74.0-0.4.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64"
        },
        "product_reference": "trivy-0:0.74.0-0.4.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.74.0-0.4.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src"
        },
        "product_reference": "trivy-0:0.74.0-0.4.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "trivy-0:0.74.0-0.4.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
        },
        "product_reference": "trivy-0:0.74.0-0.4.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-63209",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "discovery_date": "2026-09-29T15:12:15.658458+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543236"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads to out-of-bounds memory access, crashing the application and resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as having an impact of Important because an unauthenticated remote attacker could trigger a denial of service by causing a process crash without requiring elevated permissions. In Red Hat environments where this Go library is embedded, exploitation requires that an application accepts untrusted dictionary structures for S2 compression and subsequently attempts encoding. Although the resulting memory access fault terminates the vulnerable process, the flaw is confined to process crashes and does not compromise data confidentiality or integrity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
          "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
          "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63209"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543236",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543236"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63209",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63209"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63209",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63209"
        },
        {
          "category": "external",
          "summary": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536",
          "url": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"
        },
        {
          "category": "external",
          "summary": "https://github.com/klauspost/compress/releases/tag/v1.18.7",
          "url": "https://github.com/klauspost/compress/releases/tag/v1.18.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw",
          "url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
        }
      ],
      "release_date": "2026-09-29T14:58:53.366000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-28T12:58:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:72492"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing"
    },
    {
      "cve": "CVE-2026-104994",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-10-02T20:01:12.345439+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2545329"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Trivy. This vulnerability allows information disclosure when scanning untrusted Terraform configuration files for misconfigurations. An attacker can craft a configuration that uses filesystem functions to reference pathnames outside the designated scan root directory. This directory traversal enables Trivy to read unauthorized files on the host system and potentially expose sensitive data within the scan output.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/aquasecurity/trivy: Trivy: Information disclosure via directory traversal in Terraform filesystem functions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is classified as Low severity because exploitation requires Trivy to scan untrusted Terraform configurations with misconfiguration scanning enabled, and information disclosure is limited to files readable by the scanner process. Trivy typically runs in ephemeral CI/CD environments or as a local CLI tool under non-privileged accounts, limiting the blast radius. Standard container image scanning workflows are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
          "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
          "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-104994"
        },
        {
          "category": "external",
          "summary": "RHBZ#2545329",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2545329"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-104994",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-104994"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-104994",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104994"
        },
        {
          "category": "external",
          "summary": "https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md",
          "url": "https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md"
        },
        {
          "category": "external",
          "summary": "https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993",
          "url": "https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993"
        },
        {
          "category": "external",
          "summary": "https://github.com/aquasecurity/trivy/pull/10664",
          "url": "https://github.com/aquasecurity/trivy/pull/10664"
        },
        {
          "category": "external",
          "summary": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g",
          "url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g"
        }
      ],
      "release_date": "2026-10-02T19:52:36.831000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-28T12:58:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:72492"
        },
        {
          "category": "workaround",
          "details": "Run Trivy in an ephemeral, unprivileged container or sandbox when scanning untrusted Terraform configurations. Avoid mounting sensitive host paths or exposing credentials via environment variables in the scanner\u0027s execution environment. Alternatively, inspect third-party pull requests before running misconfiguration scans against them.",
          "product_ids": [
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@aarch64",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@src",
            "Red Hat Hardened Images:trivy-0:0.74.0-0.4.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "github.com/aquasecurity/trivy: Trivy: Information disclosure via directory traversal in Terraform filesystem functions"
    }
  ]
}

CVE-2026-104994 (GCVE-0-2026-104994)

Vulnerability from cvelistv5 – Published: 2026-10-02 19:52 – Updated: 2026-10-05 17:29

Summary

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.

Severity

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 17:27 UTC

CWE

CWE-24 - Path Traversal: '../filedir'

Assigner

mitre CNA under the mitre root

CNA scorecard E 27/100 over 2387 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/aquasecurity/trivy/security/ad…
https://github.com/aquasecurity/trivy/commit/9d91…
https://github.com/aquasecurity/trivy/blob/main/C…
https://github.com/aquasecurity/trivy/pull/10664

Impacted products

1 product

Vendor	Product	Version
aquasec	Trivy	Affected: 0 , < 0.71.0 (semver) cpe:2.3:a:aquasec:trivy::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T17:27:47.616968Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T17:29:18.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Terraform configuration parsing and filesystem functions"
          ],
          "product": "Trivy",
          "repo": "https://github.com/aquasecurity/trivy",
          "vendor": "aquasec",
          "versions": [
            {
              "lessThan": "0.71.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aquasec:trivy:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.71.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T19:52:36.831Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-87hp-4m93-274g"
        },
        {
          "url": "https://github.com/aquasecurity/trivy/commit/9d91b888cf63023e9c09b64259a4c1cea8dfe993"
        },
        {
          "url": "https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md"
        },
        {
          "url": "https://github.com/aquasecurity/trivy/pull/10664"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-104994",
    "datePublished": "2026-10-02T19:52:36.831Z",
    "dateReserved": "2026-10-02T19:52:35.969Z",
    "dateUpdated": "2026-10-05T17:29:18.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63209 (GCVE-0-2026-63209)

Vulnerability from cvelistv5 – Published: 2026-09-29 14:58 – Updated: 2026-09-29 16:32

Title

Integer Overflow or Wraparound and Out-of-bounds Write in compress

Summary

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 16:31 UTC

CWE

CWE-190 - Integer Overflow or Wraparound
CWE-787 - Out-of-bounds Write

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7607 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/klauspost/compress/security/ad…	x_refsource_CONFIRM
https://github.com/klauspost/compress/commit/5392…	x_refsource_MISC
https://github.com/klauspost/compress/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
klauspost	compress	Affected: < 1.18.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63209",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T16:31:39.668233Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T16:32:32.677Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compress",
          "vendor": "klauspost",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.18.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T14:58:53.366Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"
        },
        {
          "name": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536"
        },
        {
          "name": "https://github.com/klauspost/compress/releases/tag/v1.18.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/klauspost/compress/releases/tag/v1.18.7"
        }
      ],
      "source": {
        "advisory": "GHSA-259r-337f-4rfw",
        "discovery": "UNKNOWN"
      },
      "title": "Integer Overflow or Wraparound and Out-of-bounds Write in compress"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63209",
    "datePublished": "2026-09-29T14:58:53.366Z",
    "dateReserved": "2026-07-15T22:19:06.906Z",
    "dateUpdated": "2026-09-29T16:32:32.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:72492

CVE-2026-104994 (GCVE-0-2026-104994)

CVE-2026-63209 (GCVE-0-2026-63209)

Tags

Sightings

Nomenclature

Related by attack behaviour