Read the docs
TI-2026-66269 Aliases GHSA-54p8-x2m9-c593

malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.

Summary

Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources. This report is an aggregate of these individual reports for the affected code: Advisory | Affected File -- | -- `GHSA-jjgh-mc5q-gch7` | `pkg/action/scan.go` `GHSA-mwmf-fxh2-w4x7` | `pkg/archive/deb.go` `GHSA-p8j3-rpf5-gwv3` | `pkg/archive/gzip.go` `GHSA-qfh4-7f5v-75gq` | `pkg/archive/zlib.go` `GHSA-wxxf-r586-5rf5` | `pkg/archive/bzip2.go` **Fix**: #1354, #1355, #1356, #1361 **Acknowledgements** Thank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting all six of these issues.

Why it matters now

Fix Fixed github.com/chainguard-dev/malcontent (Go): 1.21.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/chainguard-dev/malcontent (Go)before 1.21.01.21.0Patch availableGHSA-54p8-x2m9-c593
  • github.com/chainguard-dev/malcontent (Go) Vendor— Affected before 1.21.0 Fixed in 1.21.0 Patch available GHSA-54p8-x2m9-c593

Remediation

  • Fix · GHSA-54p8-x2m9-c593 github.com/chainguard-dev/malcontent (Go) Fixed in 1.21.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-54p8-x2m9-c593

References

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences