CVE-2026-33481: 
NixOS vulnerability analysis and mitigation

CVE-2026-33481 is an improper temporary file cleanup vulnerability in Anchore Syft, a CLI tool and Go library for generating Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 fail to remove temporary files when an error is encountered during archive scanning, which can lead to temporary storage exhaustion. The vulnerability was published on March 20, 2026, via GitHub Advisory GHSA-rjcw-vg7j-m9rc, and assigned a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, bugzilla.redhat.com).

The root cause is classified under CWE-460 (Improper Cleanup on Thrown Exception) and CWE-459 (Incomplete Cleanup). When Syft scans archives, it unpacks them into temporary storage for inspection; under normal operation, these temporary files are removed after the scan completes. However, if the scan triggers an error — such as when temporary storage is exhausted by a very large or highly compressed artifact like a zipbomb — Syft exits without invoking the cleanup routine, leaving temporary files on disk. The fix, implemented in the stereoscope library (PR #537) and Syft itself (PRs #4629 and #4668), ensures that cleanup is called pre-emptively when a read error occurs, and introduces centralized temp directory management with automatic cleanup (Github Advisory, github.com, github.com).

Successful exploitation results in a denial-of-service condition limited to availability: temporary file storage on the host system becomes exhausted, preventing future Syft scans and potentially disrupting other system utilities that depend on temporary storage (e.g., /tmp). There is no impact on confidentiality or data integrity. The effect is localized to the host running Syft, with no evidence of lateral movement potential, but in CI/CD pipelines or automated scanning environments, repeated exploitation could render the scanning infrastructure inoperable (Github Advisory, bugzilla.redhat.com).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to supply a crafted artifact (e.g., a zipbomb) to a Syft scan, which may be feasible in environments where Syft scans untrusted or user-supplied content (Github Advisory).

1. Identify a target: Locate a system or CI/CD pipeline running Syft versions prior to v1.42.3 that scans untrusted or externally supplied archives.
2. Craft a malicious artifact: Create a highly compressed archive (e.g., a zipbomb or a very large container image tar) designed to expand to a size that exhausts the available temporary storage on the target system.
3. Submit the artifact for scanning: Supply the crafted archive to the Syft scan process — for example, by placing it in a repository, container registry, or upload endpoint that triggers automated Syft scanning.
4. Trigger the error condition: As Syft unpacks the archive into temporary storage, the storage fills up, causing Syft to raise an error and exit without cleaning up the temporary files.
5. Achieve denial of service: The leftover temporary files fill the temporary storage directory (e.g., /tmp), preventing subsequent Syft scans and potentially disrupting other system utilities that rely on temporary storage (Github Advisory, bugzilla.redhat.com).

• File System: Unexpected accumulation of large temporary files or directories in the system's temporary storage path (e.g., /tmp) associated with Syft scan operations; directories not cleaned up after Syft process termination.
• Logs: Syft error logs indicating scan failures due to storage exhaustion (e.g., "no space left on device" errors during archive unpacking); repeated Syft process exits with non-zero status codes.
• Process: Syft processes that terminate abnormally or with error codes during archive scanning, particularly when processing large or compressed artifacts such as zipbombs or oversized container images.

Upgrade Syft to version v1.42.3 or later, which includes fixes for this vulnerability via PRs #4629 and #4668 in the Syft repository and PR #537 in the Stereoscope library. There are no configuration-based workarounds available. Users who find their temporary storage already depleted can manually remove the leftover temporary files as an immediate remediation step. Additionally, implementing disk space monitoring and alerting on temporary storage directories can help detect unexpected consumption (Github Advisory, github.com, github.com).

The vulnerability was reported by security researcher htrgouvea and disclosed by Anchore maintainer willmurphyscode via the GitHub Security Advisory on March 20, 2026. Red Hat tracked the issue via Bugzilla (Bug 2451800) and classified it as medium severity. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking (Github Advisory, bugzilla.redhat.com).