Syft fails to delete temporary files when the temporary storage runs out during a scan, causing the tool to abort while leaving large amounts of unused data behind. The residual files occupy the system’s temporary space, which can prevent Syft, other utilities, or the operating system from creating new files. This problem is a resource exhaustion vulnerability, classified under CWE-460, and primarily threatens availability rather than confidentiality or integrity.

The vulnerability affects all versions of Anchore Syft preceding 1.42.3. Users running Syft to generate SBOMs from container images, file systems, or archives are at risk, especially when handling very large or highly compressed files such as zipbombs.

The CVSS score of 5.3 indicates moderate severity, and an EPSS score below 1% suggests a low likelihood of large‑scale exploitation. The attack vector is local: an adversary or a privileged user must run Syft against a suitable large or compressed artifact. Because the issue manifests only when temporary storage is exhausted, the impact is limited to environments that perform extensive scanning without monitoring tmp usage. The vulnerability is not currently listed in CISA’s KEV catalog.