anchore syft up to 1.42.2 cleanup

Summaryinfo

A vulnerability has been found in anchore syft up to 1.42.2 and classified as problematic. Affected is an unknown function. This manipulation causes cleanup. This vulnerability is handled as CVE-2026-33481. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in anchore syft up to 1.42.2. It has been declared as problematic. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a cleanup vulnerability. The CWE definition for the vulnerability is CWE-460. The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow. As an impact it is known to affect availability. The summary by CVE is:

Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the temporary data it writes after completing a scan. This vulnerability would affect users of Syft that were scanning content that could cause Syft to fill the temporary storage that would then cause Syft to raise an error and exit. When the error is triggered Syft would exit without properly removing the temporary files in use. In our testing this was most easily reproduced by scanning very large artifacts or highly compressed artifacts such as a zipbomb. Because Syft would not clean up its temporary files, the result would be filling temporary file storage preventing future runs of Syft or other system utilities that rely on temporary storage being available. The patch has been released in v1.42.3. Syft now cleans up temporary files when an error condition is encountered. There are no workarounds for this vulnerability in Syft. Users that find their temporary storage depleted can manually remove the temporary files.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-33481 since 03/20/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.42.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• anchore

Name

• syft

Version

• 1.42.0
• 1.42.1
• 1.42.2

Website

• Product: https://github.com/anchore/syft/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion