Go Standard Library Archive/Tar vulnerabilities

3 vulnerabilities

Known vulnerabilities in Go Standard Library Archive/Tar, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.3CVE-2025-58183chainguardage+2431
EPSS score
0.44%
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.7.5CVE-2022-2879chainguardkatib-earlystopping+33
EPSS score
2.01%
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.5.5CVE-2026-32288chainguardaactl+3806
EPSS score
0.18%
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.