{"id":"GHSA-54p8-x2m9-c593","aliases":["GO-2026-4583"],"status":"published","title":"malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability","description":"Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.\n\nThis report is an aggregate of these individual reports for the affected code:\nAdvisory | Affected File\n-- | --\n`GHSA-jjgh-mc5q-gch7` | `pkg/action/scan.go`\n`GHSA-mwmf-fxh2-w4x7` | `pkg/archive/deb.go`\n`GHSA-p8j3-rpf5-gwv3` | `pkg/archive/gzip.go`\n`GHSA-qfh4-7f5v-75gq` | `pkg/archive/zlib.go`\n`GHSA-wxxf-r586-5rf5` | `pkg/archive/bzip2.go`\n\n**Fix**: #1354, #1355, #1356, #1361\n\n**Acknowledgements**\n\nThank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting all six of these issues.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-03-02T18:48:03Z","modified":"2026-03-23T04:56:28Z","fixes":[{"ecosystem":"Go","package":"github.com/chainguard-dev/malcontent","fixed_in":["1.21.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/chainguard-dev/malcontent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/chainguard-dev/malcontent","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/chainguard-dev/malcontent","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.0"}]}]}],"references":[{"url":"https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-54p8-x2m9-c593","tags":["web","advisory"]},{"url":"https://github.com/chainguard-dev/malcontent/pull/1354","tags":["web","fix"]},{"url":"https://github.com/chainguard-dev/malcontent/pull/1355","tags":["web","fix"]},{"url":"https://github.com/chainguard-dev/malcontent/pull/1356","tags":["web","fix"]},{"url":"https://github.com/chainguard-dev/malcontent/pull/1361","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-54p8-x2m9-c593"},{"url":"https://github.com/chainguard-dev/malcontent","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-54p8-x2m9-c593","title":"malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability","description":"Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.\n\nThis report is an aggregate of these individual reports for the affected code:\nAdvisory | Affected File\n-- | --\n`GHSA-jjgh-mc5q-gch7` | `pkg/action/scan.go`\n`GHSA-mwmf-fxh2-w4x7` | `pkg/archive/deb.go`\n`GHSA-p8j3-rpf5-gwv3` | `pkg/archive/gzip.go`\n`GHSA-qfh4-7f5v-75gq` | `pkg/archive/zlib.go`\n`GHSA-wxxf-r586-5rf5` | `pkg/archive/bzip2.go`\n\n**Fix**: #1354, #1355, #1356, #1361\n\n**Acknowledgements**\n\nThank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting all six of these issues.","status":"published","published":"2026-03-02T18:48:03Z","modified":"2026-03-02T18:48:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:30.031684Z"}],"osv":[{"id":"GHSA-54p8-x2m9-c593","title":"malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability","description":"Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.\n\nThis report is an aggregate of these individual reports for the affected code:\nAdvisory | Affected File\n-- | --\n`GHSA-jjgh-mc5q-gch7` | `pkg/action/scan.go`\n`GHSA-mwmf-fxh2-w4x7` | `pkg/archive/deb.go`\n`GHSA-p8j3-rpf5-gwv3` | `pkg/archive/gzip.go`\n`GHSA-qfh4-7f5v-75gq` | `pkg/archive/zlib.go`\n`GHSA-wxxf-r586-5rf5` | `pkg/archive/bzip2.go`\n\n**Fix**: #1354, #1355, #1356, #1361\n\n**Acknowledgements**\n\nThank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting all six of these issues.","status":"published","published":"2026-03-02T18:48:03Z","modified":"2026-03-23T04:56:28.838404712Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"GO-2026-4583","title":"malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability in github.com/chainguard-dev/malcontent","description":"malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability in github.com/chainguard-dev/malcontent","status":"published","published":"2026-03-10T18:28:01Z","modified":"2026-03-23T04:52:46.874221Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}