Unbounded Helm archive extraction can exhaust memory in Aqua Security Trivy

Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious.tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.

• Aqua Security Trivy: releases < 0.71.0 are affected when scanning .tgz Helm chart archives through the custom tar unpacker without a size limit.
• Relevant scan targets are trivy config <dir>; trivy filesystem --scanners misconf <dir> when misconfiguration scanning is explicitly enabled; and trivy image --scanners misconf <image> when the image contains a malicious .tgz archive.
• The confirmed patched release is 0.71.0. The record supplies no additional boundaries for parallel release branches.

When scanning a Helm chart archive, Trivy's custom tar unpacker passes each entry reader to io.ReadAll(tr) without a size limit. Because .tgz is compressed, a small attacker-controlled archive can expand to gigabytes in memory. The archive must be placed where Trivy will scan it and processed as a Helm chart for the condition to occur. The advisory identifies trivy config <dir>, trivy filesystem --scanners misconf <dir> when misconfiguration scanning is enabled, and trivy image --scanners misconf <image> when the image contains the malicious archive as affected scan paths. The fix replaces the custom unpacker with an archive loader from helm.sh/helm/v4 that enforces per-entry and total content limits and validates archive structure. The exact memory threshold that causes termination depends on host or runtime limits and is not established by the record.

This is a file-content-driven flaw rather than an exploit against an independent network service. An attacker must be able to place or control a .tgz file in a repository, directory, image, or build context that Trivy scans, and a user or automation must then run the scan. CI workflows that accept pull requests or images containing untrusted content are realistic scenarios documented by the advisory. The supplied record marks public exploit as true, but it does not identify an exploit artifact, proof of concept, campaign, victim, or specific observed abuse. Known exploited status is not supplied.

• A specially crafted archive can cause Trivy to allocate memory without effective bounds until the host or runtime exhausts available resources.
• The direct technical consequence is termination of the Trivy process, preventing the scan from completing and potentially disrupting other work on the same host or runner.
• The advisory does not describe unauthorized data access, data modification, code execution, or privilege escalation; the established effect is loss of availability.
• The practical blast radius depends on resource limits and isolation applied to the host or CI runner.

Processing a malicious archive can cause the OS OOM killer to terminate Trivy, making the security scan fail. In CI environments, the pipeline may be blocked, and repeated submissions can retrigger the condition. Other processes sharing the host or CI runner may also be affected by memory exhaustion. The advisory notes that additional resource costs may occur on cloud CI runners. No disclosure of confidential data or modification of scanned-system data is identified in the available evidence.

1. Upgrade Aqua Security Trivy to 0.71.0, the confirmed patched release.
2. If an upgrade cannot be completed immediately, apply a memory limit to the Trivy process using a cgroup or container to bound the impact.
3. Use --skip-dirs to exclude directories containing untrusted Helm archives from scans.
4. Avoid scanning repositories or images containing untrusted .tgz files until the upgrade is complete.

1. Inventory Trivy binaries, container images, and CI runners, then compare them with the release confirmed to contain the fix.
2. Review scan commands and configuration for trivy config <dir>, trivy filesystem --scanners misconf <dir>, and trivy image --scanners misconf <image>.
3. Inspect scanned repositories, directories, and image build contexts for .tgz files that contributors or other untrusted sources can introduce.
4. Review OS or container OOM events and abrupt Trivy termination during scans that process Helm archives. This is precautionary monitoring, not a vulnerability-specific IOC.
5. Absence of an OOM event or failed scan does not prove safety; confirm both the deployed version and the scan data path.