Trivy version 0.72.0 addresses two security issues: CVE-2026-54448, where the tar unpacker reads Helm chart archives (.tgz) using io.ReadAll without imposing size limits, potentially leading to denial of service; and CVE-2026-55092, where the org.opencontainers.image.title annotation from an OCI artifact manifest is used as a destination filename without validation, allowing arbitrary file writes. The update mitigates these vulnerabilities by implementing appropriate size limits and validation.

The vulnerabilities could allow an attacker to cause a denial of service by exhausting resources during tar archive unpacking or to perform arbitrary file writes by exploiting unvalidated filename usage. This could lead to disruption of service or unauthorized modification of files when processing malicious Helm chart archives or OCI artifacts.

Users should update Trivy to version 0.72.0 or later, where these vulnerabilities have been fixed. No additional mitigation steps are indicated beyond applying this official update.