Temporary File Management Issue in Syft CLI Tool by Anchore

CVE-2026-33481

What is CVE-2026-33481?

Syft is a command-line interface tool and Go library designed for generating a Software Bill of Materials (SBOM) from container images and filesystems. Versions of Syft prior to v1.42.3 display a vulnerability regarding the management of temporary storage. When scanning large or highly compressed files, Syft may exhaust its temporary storage, leading to an error that causes it to terminate prematurely. This abrupt exit prevents Syft from properly clearing temporary files, potentially filling up the system's temporary storage. Such a situation can impede subsequent runs of Syft and other utilities dependent on available temporary storage. The issue has been addressed in version 1.42.3, where Syft has been updated to ensure that temporary files are cleaned up even when errors occur, although there are no workarounds for users currently impacted by depleted temporary storage.

References