diff --git a/pkg/osvscanner/osvscanner.go b/pkg/osvscanner/osvscanner.go
index e3e86a81efc..b5c131eb73c 100644
--- a/pkg/osvscanner/osvscanner.go
+++ b/pkg/osvscanner/osvscanner.go
@@ -97,6 +97,13 @@ type TransitiveScanningActions struct {
 	MavenRegistry    string
 }
 
+// defaultMaxFileSize caps per-file memory allocation for extractors.
+// Rationale: 20+ lockfile extractors call io.ReadAll(input.Reader) with no
+// per-parser limit; without a cap, a repository or container-image layer
+// entry can allocate arbitrary memory during extraction. 512 MiB matches
+// the image-layer scanner's MaxFileBytes default in osv-scalibr.
+const defaultMaxFileSize = 512 * 1024 * 1024
+
 type ExternalAccessors struct {
 	// Matchers
 	VulnMatcher    clientinterfaces.VulnerabilityMatcher
@@ -323,6 +330,7 @@ func DoContainerScan(actions ScannerActions) (models.VulnerabilityResults, error
 		Capabilities:      capabilities,
 		StoreAbsolutePath: true,
 		ExplicitPlugins:   true,
+		MaxFileSize:       defaultMaxFileSize,
 	})
 	if err != nil {
 		return models.VulnerabilityResults{}, fmt.Errorf("failed to scan container image: %w", err)
diff --git a/pkg/osvscanner/scan.go b/pkg/osvscanner/scan.go
index f53fb572cab..fda1aec1f37 100644
--- a/pkg/osvscanner/scan.go
+++ b/pkg/osvscanner/scan.go
@@ -238,6 +238,7 @@ SBOMLoop:
 	// For each root, run scalibr's scan() once.
 	for root, paths := range rootMap {
 		sr := scanner.Scan(context.Background(), &scalibr.ScanConfig{
+		MaxFileSize:           defaultMaxFileSize,
 			Plugins:               filteredPlugins,
 			Capabilities:          &capabilities,
 			ScanRoots:             fs.RealFSScanRoots(root),