CVE-2026-33481
CVE-2026-33481 is a medium-severity vulnerability in Anchore Syft with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-460.
Key facts
- Severity: Medium (CVSS 3.x base score 5.3)
- EPSS exploit prediction: 0% (33rd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-16279
- Weakness: CWE-460
- Affected product: Anchore Syft
- Published:
- Last modified:
Description
Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the temporary data it writes after completing a scan. This vulnerability would affect users of Syft that were scanning content that could cause Syft to fill the temporary storage that would then cause Syft to raise an error and exit. When the error is triggered Syft would exit without properly removing the temporary files in use. In our testing this was most easily reproduced by scanning very large artifacts or highly compressed artifacts such as a zipbomb. Because Syft would not clean up its temporary files, the result would be filling temporary file storage preventing future runs of Syft or other system utilities that rely on temporary storage being available. The patch has been released in v1.42.3. Syft now cleans up temporary files when an error condition is encountered. There are no workarounds for this vulnerability in Syft. Users that find their temporary storage depleted can manually remove the temporary files.
Frequently asked questions
- What is CVE-2026-33481?
- Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the temporary data it writes after completing a scan. This vulnerability would affect users of Syft that were scanning content that could cause Syft to fill the temporary storage that would then cause Syft to raise an error and exit. When the error is triggered Syft would exit without properly removing the temporary files in use. In our testing this was most easily reproduced by scanning very large artifacts or highly compressed artifacts such as a zipbomb. Because Syft would not clean up its temporary files, the result would be filling temporary file storage preventing future runs of Syft or other system utilities that rely on temporary storage being available. The patch has been released in v1.42.3. Syft now cleans up temporary files when an error condition is encountered. There are no workarounds for this vulnerability in Syft. Users that find their temporary storage depleted can manually remove the temporary files.
- How severe is CVE-2026-33481?
- CVE-2026-33481 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
- Is CVE-2026-33481 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-33481?
- CVE-2026-33481 affects Anchore Syft. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-33481?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-33481 have an EU (EUVD) identifier?
- Yes. CVE-2026-33481 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-16279.
- When was CVE-2026-33481 published?
- CVE-2026-33481 was published on 2026-03-26 and last updated on 2026-06-17.
References
- https://github.com/anchore/stereoscope/pull/537
- https://github.com/anchore/syft/pull/4629
- https://github.com/anchore/syft/pull/4668
- https://github.com/anchore/syft/security/advisories/GHSA-rjcw-vg7j-m9rc
Affected products (1)
- cpe:2.3:a:anchore:syft:*:*:*:*:*:*:*:*
More vulnerabilities in Anchore Syft
- CVE-2023-24827 — Medium (CVSS 6.5): syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and…
All CVEs affecting Anchore Syft →
Other CWE-460 vulnerabilities
- CVE-2026-40583 — High (CVSS 8.2): UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed…
- CVE-2023-46393 — High (CVSS 7.5): gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to…
- CVE-2026-20118 — Medium (CVSS 6.8): A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software…
- CVE-2024-0316 — Medium (CVSS 6.8): Improper cleanup vulnerability in exceptions thrown in FireEye Endpoint Security, affecting version 5.2.0.958244. This…
- CVE-2025-32439 — Medium (CVSS 6.5): pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track…
- CVE-2025-30157 — Medium (CVSS 6.5): Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10,…