Homepage

Allocation of Resources Without Limits or Throttling Affecting trivy-operator-fips package, versions <0.33.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.4% (34th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-TRIVYOPERATORFIPS-19130286
  • published21 Aug 2026
  • disclosed19 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Aug 2026

NewCVE-2026-61712  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade Minimos:latest trivy-operator-fips to version 0.33.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream trivy-operator-fips package and not the trivy-operator-fips package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.