CVE-2026-33481 affects Anchore Syft versions prior to v1.42.3, where the tool fails to properly clean up temporary files if a scan errors due to exhausted temporary storage, such as when processing very large or highly compressed archives. Rated Medium with a CVSS score of 5.3 (AV:N/AC:L/A:L), this vulnerability can lead to a denial of service by filling the system's temporary storage, preventing Syft and other applications from functioning. The attack vector is network-based with low complexity, but only impacts availability. There is no evidence of active exploitation, and no public exploit code is available. Community discussion and media coverage are minimal, and the vulnerability is not listed on the CISA KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.42.3CPE matchmatch criteria | cpe:2.3:a:anchore:syft:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.