Threats affecting pkg:github/anchore/syft

CVE-2026-33481 is a medium severity vulnerability in Anchore Syft versions prior to 1.42.3 where temporary files are not properly cleaned up if an error occurs due to exhausted temporary storage during scanning. This can happen when scanning very large or highly compressed artifacts, causing Syft to exit without removing temporary files, which may fill the temporary storage and prevent future scans or other system utilities from functioning properly. The issue is fixed in Syft version 1.42.3, which ensures cleanup of temporary files even on error. No workarounds exist, but manual removal of leftover temporary files can restore storage availability.