GHSA-54p8-x2m9-c593
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability
Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.
This report is an aggregate of these individual reports for the affected code:
Advisory | Affected File
-- | --
GHSA-jjgh-mc5q-gch7 | pkg/action/scan.go
GHSA-mwmf-fxh2-w4x7 | pkg/archive/deb.go
GHSA-p8j3-rpf5-gwv3 | pkg/archive/gzip.go
GHSA-qfh4-7f5v-75gq | pkg/archive/zlib.go
GHSA-wxxf-r586-5rf5 | pkg/archive/bzip2.go
Fix: #1354, #1355, #1356, #1361
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting all six of these issues.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability
Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.
This report is an aggregate of these individual reports for the affected code:
Advisory | Affected File
-- | --
GHSA-jjgh-mc5q-gch7 | pkg/action/scan.go
GHSA-mwmf-fxh2-w4x7 | pkg/archive/deb.go
GHSA-p8j3-rpf5-gwv3 | pkg/archive/gzip.go
GHSA-qfh4-7f5v-75gq | pkg/archive/zlib.go
GHSA-wxxf-r586-5rf5 | pkg/archive/bzip2.go
Fix: #1354, #1355, #1356, #1361
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting all six of these issues.
- Record
GHSA-54p8-x2m9-c593- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability
Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.
This report is an aggregate of these individual reports for the affected code:
Advisory | Affected File
-- | --
GHSA-jjgh-mc5q-gch7 | pkg/action/scan.go
GHSA-mwmf-fxh2-w4x7 | pkg/archive/deb.go
GHSA-p8j3-rpf5-gwv3 | pkg/archive/gzip.go
GHSA-qfh4-7f5v-75gq | pkg/archive/zlib.go
GHSA-wxxf-r586-5rf5 | pkg/archive/bzip2.go
Fix: #1354, #1355, #1356, #1361
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting all six of these issues.
- Record
GHSA-54p8-x2m9-c593- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGO-2026-4583No score
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability in github.com/chainguard-dev/malcontent
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability in github.com/chainguard-dev/malcontent
- Record
GO-2026-4583- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/chainguard-dev/malcontentGo | before 1.21.0 | 1.21.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-54p8-x2m9-c593 is a medium vulnerability (CVSS 5.3) in github.com/chainguard-dev/malcontent, published March 2, 2026. No source lists public exploit code. Fixed in github.com/chainguard-dev/malcontent 1.21.0.
References
github.com/chainguard-dev/malcontent/security/advisories/GHSA-54p8-x2m9-c593