syft
v1.57.1CLI tool and library for generating a Software Bill of Materials from container images and filesystems
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 3 advisories3 medium · Scorecard 8.5/10
- Supported versions
- No scheduleendoflife.date does not track this project
9.9k stars · 1.1k forks · 723 open issues · last release 6 days ago · data checked 3 hours ago
Security advisories
All advisories on GitHubThe 3 most recent advisories published by the maintainers: 3 medium. Check the patched version against the one you run.
- mediumGHSA-mw2c-m758-9v5qSep 17, 2026Memory exhaustion and large allocations when parsing binary inputs
- Affected
- < v1.52.0
- Patched in
- v1.52.0
- mediumCVE-2026-33481Mar 20, 2026Syft improper temporary file cleanup
- Affected
- < v1.42.3
- Patched in
- v1.42.3
- mediumCVE-2023-24827Feb 6, 2023Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set
- Affected
- >= v0.69.0 && < v0.70.0
- Patched in
- v0.70.0