Skip to content
Sign in
5.5 Medium

CVE-2026-32288 tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large…

Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Affected products and versions

Product Affected versions Fixed in
archive/tar 1.26 1.26.0-0 → < 1.26.2 1.26.2
archive/tar 1.25 earliest → < 1.25.9 1.25.9

Other CVEs of archive/tar

The 3 CVEs of archive/tar →
CVE-2025-58183 tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files 4.3 Medium CVE-2022-2879 Reader.Read does not set a limit on the maximum size of file headers Not rated
Track this CVE