GHSA-54p8-x2m9-c593 json
malcontent: Error-path cleanup gap can leak scanners and fds and degrade availability
published 8mo ago modified 7mo ago also GO-2026-4583
- cvss
- 5.3
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources.
This report is an aggregate of these individual reports for the affected code: Advisory | Affected File -- | -- `GHSA-jjgh-mc5q-gch7` | `pkg/action/scan.go` `GHSA-mwmf-fxh2-w4x7` | `pkg/archive/deb.go` `GHSA-p8j3-rpf5-gwv3` | `pkg/archive/gzip.go` `GHSA-qfh4-7f5v-75gq` | `pkg/archive/zlib.go` `GHSA-wxxf-r586-5rf5` | `pkg/archive/bzip2.go`
**Fix**: #1354, #1355, #1356, #1361
**Acknowledgements**
Thank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting all six of these issues.
Patch / fix
- go github.com/chainguard-dev/malcontent 1.21.0
- github.com/chainguard-dev/malcontent#1354 pull request
- github.com/chainguard-dev/malcontent#1355 pull request
- github.com/chainguard-dev/malcontent#1356 pull request
- github.com/chainguard-dev/malcontent#1361 pull request
Is GHSA-54p8-x2m9-c593 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/chainguard-dev/malcontent | <1.21.0 |
1.21.0 |
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/chainguard-dev/malcontent/pull/1354
web, patch
-
github.com
/chainguard-dev/malcontent/pull/1355
web, patch
-
github.com
/chainguard-dev/malcontent/pull/1356
web, patch
-
github.com
/chainguard-dev/malcontent/pull/1361
web, patch
-
github.com
/chainguard-dev/malcontent/security/advisories/GHSA-54p8-x2m9-c593
web, advisory
-
github.com
/chainguard-dev/malcontent
package
Sources
- GitHub Advisory GHSA-54p8-x2m9-c593
- OSV GO-2026-4583
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.