The vulnerability is that Syft, when scanning large or highly compressed archive contents, fills temporary storage. When the scan fails due to exhausted temp storage, Syft exits without removing the temp files it created, leaving stale files that consume storage permanently. This results in a denial of service for both Syft and other system utilities that depend on temporary storage, because the disk becomes full and future scans or processes cannot start. The weakness stems from improper resource shutdown, identified as CWE‑460.

The affected software is the Syft CLI and Go library developed by Anchore. Versions prior to 1.42.3 are susceptible. Users running any older release that performs assembly or analysis of container images, filesystem snapshots, or arbitrary archives may experience the problem. The volatility of the issue is highest when processing large or maliciously compressed artifacts such as zip bombs, which rapidly consume temporary space.

CVSS 5.3 indicates a moderate level of severity. Exploitation is a local threat: an attacker who can run Syft with sufficient privileges and supply a large archive can trigger the failure. The absence of an EPSS score and lack of listing in CISA’s KEV catalog imply no widespread active exploitation yet. However, the flaw remains exploitable on systems where Syft or its integrated scanning components run under user accounts with write access to the system’s temporary directory. Proper cleanup is now implemented in version 1.42.3, so applying the update mitigates the issue.