CVE-2026-33481: Syft Improper Temporary File Cleanup Vulnerability
Summary
CVE-2026-33481: Syft improper temporary file cleanup. Affects github.com/anchore/syft versions < 1.42.3. Fixed in 1.42.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Syft is an open-source tool developed by Anchore that enables users to generate a Software Bill of Materials (SBOM) for container images and filesystems. It inspects the contents of archives and generates detailed reports about the components and licenses present. However, prior to version 1.42.3, Syft had a vulnerability that could lead to improper cleanup of temporary files, particularly when scanning large or highly compressed artifacts.
Vulnerability Detail
The vulnerability arises from Syft's failure to properly clean up temporary storage when it encounters an error due to exhausted temporary storage during a scan. When scanning archives, Syft unpacks the contents into temporary storage, and under normal circumstances, it removes these files after the scan. However, if the temporary storage is filled, Syft raises an error and exits without removing the temporary files, leading to potential depletion of temporary storage. This can prevent future runs of Syft or other system utilities that rely on available temporary storage.
How To Fix
Latest published version: v1.55.0 as of 23 Oct 2026
go get github.com/anchore/syft@v1.55.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.42.3
This is the first release that contains the fix.
go get github.com/anchore/syft@v1.42.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds for this vulnerability. Users experiencing depleted temporary storage can manually remove the temporary files created by Syft to free up space.
Conclusion
In summary, CVE-2026-33481 represents a significant vulnerability in Syft versions prior to 1.42.3, where improper cleanup of temporary files can lead to storage depletion. Users are advised to update to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for github.com/anchore/syft →
FAQ
The impact includes the potential exhaustion of temporary storage, which can hinder the operation of Syft and other system utilities that depend on available temporary storage.
You can check your version of Syft by running 'syft version' in your terminal. If it is below 1.42.3, it is affected by this vulnerability.
If you cannot update immediately, you should monitor your temporary storage usage and manually clean up temporary files created by Syft to avoid running out of space.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software without requiring code access. You can also check if your application is affected using the Vulert playground.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/anchore/syft.
