Malformed yaml file causes segfault with ansible scanning

[rtiainen]

Description

When scanning a malformed yaml file

-
- name: foo

Trivy crashes with SIGSEGV, as follows:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation

goroutine 1 [running]:
github.com/aquasecurity/trivy/pkg/iac/scanners/ansible/parser.(*Play).Hosts(...)
        /home/runner/work/trivy/trivy/pkg/iac/scanners/ansible/parser/play.go:66
github.com/aquasecurity/trivy/pkg/iac/scanners/ansible/parser.isPlaybookFile.func1(...)
        /home/runner/work/trivy/trivy/pkg/iac/scanners/ansible/parser/discovery.go:82
slices.IndexFunc[...](...)
        /opt/hostedtoolcache/go/1.25.5/x64/src/slices/slices.go:109
slices.ContainsFunc[...](...)
        /opt/hostedtoolcache/go/1.25.5/x64/src/slices/slices.go:124
...

Desired Behavior

Scanning of the file without an error. It should be noted that Ansible does accept files with a single dash in the beginning of the file without complaints.

Actual Behavior

Crash as described earlier

Reproduction Steps

1. Create a yaml file that that has the content described above.
2. Scan the file with Trivy: trivy config foo.yml
3. Observe the crash

Target

Filesystem

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Debug Output

2026-02-03T11:00:58Z    DEBUG   No plugins loaded
2026-02-03T11:00:58Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2026-02-03T11:00:58Z    DEBUG   Cache dir       dir="/home/xxx/.cache/trivy"
2026-02-03T11:00:58Z    DEBUG   Cache dir       dir="/home/xxx/.cache/trivy"
2026-02-03T11:00:58Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-02-03T11:00:58Z    INFO    [misconfig] Misconfiguration scanning is enabled
2026-02-03T11:00:58Z    INFO    [checks-client] Using existing checks from cache        path="/home/xxx/.cache/trivy/policy/content"
2026-02-03T11:00:58Z    DEBUG   [notification] Running version check
2026-02-03T11:00:58Z    DEBUG   [misconfig] Checks successfully loaded from disk
2026-02-03T11:00:58Z    DEBUG   [notification] Failed getting response from Trivy api   err="Get \"https://check.trivy.dev/updates\": dial tcp: lookup check.trivy.dev on 127.0.0.1:53: server misbehaving"
2026-02-03T11:00:58Z    DEBUG   [rego] Overriding filesystem for checks
2026-02-03T11:00:58Z    DEBUG   [rego] Embedded libraries are loaded    count=17
2026-02-03T11:00:59Z    DEBUG   [rego] Embedded checks are loaded       count=563
2026-02-03T11:00:59Z    DEBUG   [rego] Checks from disk are loaded      count=536
2026-02-03T11:00:59Z    DEBUG   [rego] Overriding filesystem for data
2026-02-03T11:00:59Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot ansible]
2026-02-03T11:00:59Z    DEBUG   Initializing scan cache...      type="memory"
2026-02-03T11:00:59Z    DEBUG   [fs] Analyzing...       root="foo.yml"
2026-02-03T11:00:59Z    DEBUG   [fs] Random cache key will be used      err="failed to open git repository: stat /tmp/foo.yml/.git: not a directory"
2026-02-03T11:00:59Z    DEBUG   Created process-specific temp directory path="/tmp/trivy-2443157"
2026-02-03T11:00:59Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Helm"
2026-02-03T11:00:59Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Ansible"
2026-02-03T11:00:59Z    DEBUG   Cleaning up temp directory      path="/tmp/trivy-2443157"
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x23eb19b]

Operating System

Ubuntu 22.04.5 LTS

Version

Version: 0.69.0
Check Bundle:
  Digest: sha256:a55ef4122a1683407bb0f85cbfa95b5b4622376292463b908f71230ae1534b02
  DownloadedAt: 2026-02-03 11:09:23.554590651 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @rtiainen !

Thanks for the report. Track #10131