CVE-2026-33481

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>syft</name>
	<range><lt>1.42.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Syft is a a CLI tool and Go library for generating a Software Bill of
	Materials (SBOM) from container images and filesystems. Syft versions
	before v1.42.3 would not properly cleanup temporary storage if the
	temporary storage was exhausted during a scan. When scanning archives
	Syft will unpack those archives into temporary storage then inspect
	the unpacked contents. Under normal operation Syft will remove the
	temporary data it writes after completing a scan. This vulnerability
	would affect users of Syft that were scanning content that could cause
	Syft to fill the temporary storage that would then cause Syft to raise
	an error and exit. When the error is triggered Syft would exit without
	properly removing the temporary files in use. In our testing this was
	most easily reproduced by scanning very large artifacts or highly
	compressed artifacts such as a zipbomb. Because Syft would not clean
	up its temporary files, the result would be filling temporary file
	storage preventing future runs of Syft or other system utilities that
	rely on temporary storage being available. The patch has been released
	in v1.42.3. Syft now cleans up temporary files when an error condition
	is encountered. There are no workarounds for this vulnerability in
	Syft. Users that find their temporary storage depleted can manually
	remove the temporary files.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-33481</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-33481</url>
    </references>
    <dates>
      <discovery>2026-03-26</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>