Not rated

CVE-2022-2879 Reader.Read does not set a limit on the maximum size of file headers

Description

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

Affected products and versions

Product	Affected versions	Fixed in
archive/tar 1.19	1.19.0-0 → < 1.19.2	1.19.2
archive/tar 1.18	earliest → < 1.18.7	1.18.7

References

go.dev go.dev
go.dev go.dev
groups.google.com groups.google.com
pkg.go.dev pkg.go.dev
security.gentoo.org security.gentoo.org

Timeline

Published October 14, 2022
Last modified February 13, 2025

The 3 CVEs of archive/tar →

CVE-2026-32288 tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large… 5.5 Medium CVE-2025-58183 tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files 4.3 Medium

Track this CVE

CVE-2022-2879 Reader.Read does not set a limit on the maximum size of file headers

Description

Affected products and versions

References

Timeline

Other CVEs of archive/tar