PT-2026-60978 · Aqua Security · Trivy
CVSS v3.1
9.8
Critical
| Base vector | Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
trivy versions prior to 0.72.0-2.1
Description
A
norm.Iter can enter an infinite loop when processing input that contains invalid UTF-8 bytes. UTF-8 is a character encoding capable of encoding all possible Unicode characters.Recommendations
Update to version 0.72.0-2.1.
Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
AZL-93075
AZL-93078
AZL-93081
AZL-93087
AZL-93093
AZL-93099
AZL-93105
AZL-93108
AZL-93111
AZL-93141
AZL-93144
AZL-93147
AZL-93150
AZL-93153
AZL-93156
AZL-93159
AZL-93162
AZL-93165
AZL-93168
AZL-93171
AZL-93174
AZL-93177
AZL-93183
AZL-93186
AZL-93201
AZL-93204
AZL-93207
AZL-93210
AZL-93213
AZL-93216
AZL-93219
AZL-93222
AZL-93225
AZL-93228
AZL-93261
AZL-93264
AZL-93267
AZL-93273
AZL-93276
AZL-93279
AZL-93282
AZL-93285
AZL-93315
AZL-93318
AZL-93321
AZL-93327
CLEANSTART-2026-BF01272
CLEANSTART-2026-BI19096
CLEANSTART-2026-EP65920
CLEANSTART-2026-GY91527
CLEANSTART-2026-HP74907
CLEANSTART-2026-JT42679
CLEANSTART-2026-JV36933
CLEANSTART-2026-KB08955
CLEANSTART-2026-KL21881
CLEANSTART-2026-LD38774
CLEANSTART-2026-LD95637
CLEANSTART-2026-LN45890
CLEANSTART-2026-OM32721
CLEANSTART-2026-PH23874
CLEANSTART-2026-PY84482
CLEANSTART-2026-RT37134
CLEANSTART-2026-RV11606
CLEANSTART-2026-SO86245
CLEANSTART-2026-UM67329
CLEANSTART-2026-VU72808
CLEANSTART-2026-VY16523
CLEANSTART-2026-WT22902
CLEANSTART-2026-YT82900
CLEANSTART-2026-ZA15834
CVE-2026-56852
GO-2026-5970
OPENSUSE-SU-2026:11302-1
OPENSUSE-SU-2026:11328-1
OPENSUSE-SU-2026:11333-1
OPENSUSE-SU-2026:11334-1
OPENSUSE-SU-2026:11345-1
OPENSUSE-SU-2026:11348-1
OPENSUSE-SU-2026:11349-1
OPENSUSE-SU-2026:11366-1
OPENSUSE-SU-2026:11374-1
OPENSUSE-SU-2026:11376-1
OPENSUSE-SU-2026:11382-1
OPENSUSE-SU-2026:11392-1
OPENSUSE-SU-2026:11404-1
OPENSUSE-SU-2026:11436-1
OPENSUSE-SU-2026:11444-1
OPENSUSE-SU-2026:11514-1
OPENSUSE-SU-2026:11520-1
OPENSUSE-SU-2026:11684-1
OPENSUSE-SU-2026:11731-1
OPENSUSE-SU-2026:21395-1
OPENSUSE-SU-2026:21422-1
OPENSUSE-SU-2026:21441-1
OPENSUSE-SU-2026:21454-1
OPENSUSE-SU-2026:21455-1
OPENSUSE-SU-2026:21456-1
OPENSUSE-SU-2026:21473-1
OPENSUSE-SU-2026:21476-1
OPENSUSE-SU-2026:21480-1
OPENSUSE-SU-2026:21482-1
OPENSUSE-SU-2026:21483-1
OPENSUSE-SU-2026:21499-1
OPENSUSE-SU-2026:21500-1
OPENSUSE-SU-2026:21509-1
OPENSUSE-SU-2026:21590-1
OPENSUSE-SU-2026:21761-1
RHSA-2026:40964
RHSA-2026:41020
RHSA-2026:42083
RHSA-2026:42230
RHSA-2026:42241
RHSA-2026:43015
RHSA-2026:43119
RHSA-2026:43311
RHSA-2026:43554
RHSA-2026:43581
RHSA-2026:43716
RHSA-2026:43797
RHSA-2026:43799
RHSA-2026:43801
RHSA-2026:43803
RHSA-2026:43852
RHSA-2026:43866
RHSA-2026:43873
RHSA-2026:43906
RHSA-2026:44151
RHSA-2026:44152
RHSA-2026:44162
RHSA-2026:44430
RHSA-2026:44451
RHSA-2026:44479
RHSA-2026:46953
RHSA-2026:46960
RHSA-2026:46988
RHSA-2026:48306
RHSA-2026:49317
RHSA-2026:49360
RHSA-2026:51065
RHSA-2026:52912
RHSA-2026:54364
RHSA-2026:54549
SUSE-SU-2026:22855-1
SUSE-SU-2026:22934-1
SUSE-SU-2026:22945-1
SUSE-SU-2026:22952-1
SUSE-SU-2026:22994-1
SUSE-SU-2026:22996-1
SUSE-SU-2026:23041-1
SUSE-SU-2026:23051-1
SUSE-SU-2026:23052-1
SUSE-SU-2026:23057-1
SUSE-SU-2026:23073-1
SUSE-SU-2026:23077-1
SUSE-SU-2026:23162-1
SUSE-SU-2026:23170-1
SUSE-SU-2026:3265-1
SUSE-SU-2026:3266-1
SUSE-SU-2026:3267-1
SUSE-SU-2026:3300-1
SUSE-SU-2026:3327-1
SUSE-SU-2026:3342-1
SUSE-SU-2026:3417-1
SUSE-SU-2026:3432-1
SUSE-SU-2026:3439-1
SUSE-SU-2026:3480-1
SUSE-SU-2026:3496-1
SUSE-SU-2026:3497-1
SUSE-SU-2026:3528-1
SUSE-SU-2026:3630-1
SUSE-SU-2026:3916-1
Affected Products
Trivy
References · 2336
- https://osv.dev/vulnerability/AZL-93285 · Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27137 · Security Note
- https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
- https://osv.dev/vulnerability/CLEANSTART-2026-EP65920 · Vendor Advisory
- https://osv.dev/vulnerability/openSUSE-SU-2026:11444-1 · Vendor Advisory
- https://osv.dev/vulnerability/AZL-93204 · Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41080 · Security Note
- https://osv.dev/vulnerability/SUSE-SU-2026:23170-1 · Vendor Advisory
- https://osv.dev/vulnerability/SUSE-SU-2026:3342-1 · Vendor Advisory
- https://osv.dev/vulnerability/CLEANSTART-2026-YT82900 · Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-39828 · Security Note
- https://osv.dev/vulnerability/SUSE-SU-2026:3497-1 · Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61724 · Security Note
- https://osv.dev/vulnerability/CLEANSTART-2026-VU72808 · Vendor Advisory
- https://osv.dev/vulnerability/AZL-93261 · Vendor Advisory