openSUSE Pushes Trivy 0.76.0 Update Closing Three Flaws Including a High Scoring zlib Issue
openSUSE has published openSUSE-SU-2026:0353-1, rated important, which rebuilds the trivy vulnerability scanner package for openSUSE Backports SLE-15-SP7. Three CVEs are in scope: CVE-2026-19585, carrying a SUSE CVSS v4.0 score of 7.1 and requiring user interaction for an integrity-only impact, and CVE-2026-85091, scored 9.0 under CVSS v4.0 with high integrity and availability impact plus a changed-scope confidentiality element. A third issue, CVE-2026-78669, is scored 7.5 under CVSS v3.1 with availability as the sole impact. The fix is delivered by updating trivy to version 0.76.0 and is tracked internally under bug references boo#1284829 and boo#1285541. Only the openSUSE Backports SLE-15-SP7 product is listed as affected.
The advisory does not publish exploitation details for any of the three CVEs, and no proof-of-concept or attack chain is described, so what follows is limited to what the release itself documents. CVE-2026-85091 is addressed indirectly rather than in trivy's own code: the 0.76.0 release pins zlib to version 1.3.2-r1 or later in the project's container images, meaning the exposure came from a bundled compression library in the published image rather than from the scanner binary. For the other two issues the advisory identifies only the version that resolves them. The wider 0.76.0 and 0.75.0 changelogs do show a cluster of robustness work in the areas an attacker-supplied file would touch, including fixes to avoid panics when processing CSAF advisories with no CVE, CSAF relationships without a sub-component, malformed dependency files and version-less Amazon Linux release data, along with handling for null entries in SPDX file and package arrays. That pattern is consistent with the availability-only CVSS vector recorded for CVE-2026-78669, though the advisory does not explicitly link any changelog entry to a specific CVE.
The practical concern here is positional rather than dramatic. Trivy is a scanner that organisations point at untrusted material by design, pulling in container images, SBOM documents, dependency manifests, Terraform plans and third-party VEX and CSAF feeds, and it frequently runs inside CI/CD pipelines and build hosts with registry credentials and repository access attached. A flaw that lets crafted input crash the scanner degrades the control that is supposed to be gating releases, and silent scanner failure in a pipeline is the kind of condition that gets retried rather than investigated. The container-image exposure in CVE-2026-85091 also matters to teams that consume the upstream trivy image rather than the distribution package, since the vulnerable zlib was shipped inside the image rather than in the package tree. On current exploitation status, FIRST EPSS places CVE-2026-19585 at a 0.2 percent probability of exploitation in the next 30 days, CVE-2026-78669 at 0.6 percent and CVE-2026-85091 at 0.4 percent. There is no indication in the advisory or in that data of in-the-wild activity against any of the three, and all are resolved in the published release.
Attack Surface
Supply Chain (Third-party vendors), Server OS, Infrastructure
Tactics
Initial Access, Impact
Techniques
- T1195.001 – Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1499 – Endpoint Denial of Service
- T1203 – Exploitation for Client Execution
SuperPRO's Threat Countermeasures Procedures
- Apply openSUSE-SU-2026:0353-1 on openSUSE Backports SLE-15-SP7 hosts to bring the trivy package to version 0.76.0, which resolves CVE-2026-19585 and CVE-2026-78669 (tracked as boo#1284829 and boo#1285541).
- Align any trivy container image in use with the 0.76.0 release, which the release notes record as pinning zlib to 1.3.2-r1 or later in the project's container images to fix CVE-2026-85091 (change #11407).
- Treat trivy 0.76.0 as the fixed baseline named in openSUSE-SU-2026:0353-1 and confirm with trivy –version that the binary in use reports 0.76.0 or later, as the advisory documents no fix in any earlier release.
- Confirm the update actually landed by checking that rpm -q trivy on each openSUSE Backports SLE-15-SP7 host reports version 0.76.0 or later, which is the version openSUSE-SU-2026:0353-1 names as resolving all three CVEs.
- Ensure the openSUSE Backports SLE-15-SP7 update repository is enabled on affected hosts, since that product channel is the only one listed in openSUSE-SU-2026:0353-1 as carrying the trivy 0.76.0 package.
- Note that the documented remedy for CVE-2026-85091 is the zlib floor of 1.3.2-r1 introduced with trivy 0.76.0, so a zlib build below 1.3.2-r1 sits outside the version range the release pins.
- Where trivy 0.76.0 cannot yet be installed, note that openSUSE-SU-2026:0353-1 publishes no workaround or configuration change for CVE-2026-19585, CVE-2026-78669 or CVE-2026-85091, leaving the package or image update as the only documented remedy; the bug references boo#1284829 and boo#1285541 carry any further vendor detail.
