The update for Trivy fixes several vulnerabilities: CVE-2026-24122 involves improper validation of certificates that outlive expired CA certificates in the cosign package; CVE-2026-37236 allows clients to override HTTP methods via the X-HTTP-Method-Override header, bypassing access control in grpc-gateway; CVE-2026-41178 permits denial of service through oversized baggage headers in OpenTelemetry; CVE-2026-50163 enables information disclosure and arbitrary file access via crafted tarball hardlinks in oras-go; CVE-2026-56854, CVE-2026-56855, and CVE-2026-78662 relate to authentication bypass and deadlocks in the golang.org/x/crypto/ssh library; CVE-2026-84303 allows bypass of authorization policies due to header case handling in grpc-go; CVE-2026-84304 causes heap memory exhaustion via HTTP/2 DATA frame fragmentation in grpc-go; and CVE-2026-84445 leads to denial of service from missing :authority and Host headers in gRPC-Go xDS servers. These vulnerabilities affect multiple components used by Trivy and have been addressed in this update.

The vulnerabilities fixed in this update can lead to various impacts including improper certificate validation potentially undermining trust, bypass of access controls allowing unauthorized actions, denial of service conditions via resource exhaustion or crashes, information disclosure through crafted inputs, and authentication bypass or deadlocks affecting SSH connections. The severity of these impacts varies by vulnerability but collectively they represent significant security risks if left unpatched.

A security update for Trivy has been released that addresses all listed vulnerabilities. Users should apply this update promptly to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.