CVE-2026-9538: bingos archive::tar

CVSS: 7.5v3.1HighModified

AliasesRHSA-2026:48225RHSA-2026:49523RHSA-2026:49524+3 more

Published 26-05-2026Last modified 28-05-2026

Vulnerability summary

CVE-2026-9538 is a high (CVSS 7.5) vulnerability in bingos archive::tar. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.45%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

MGASA-2026-0230 USN-8684-1

Timeline

26-05-2026
PublishedVulnerability first disclosed.
28-05-2026
Last modifiedVulnerability information updated.

Description

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

0.45%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

0.00 pp

From 0.45% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected systems

Redhat197 products

perl< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-Algorithm-Diff< 0:1.1903-10.module+el8.10.0+21354+3ad137bb
perl-Archive-Tar< 0:2.38-5.module+el8.10.0+24544+66a14188 | < 0:3.02-512.el10_2.2 | < 0:2.30-3.el8_10 | < 0:2.38-6.el9_8.2
perl-Archive-Zip< 0:1.68-3.module+el8.10.0+21354+3ad137bb
perl-Attribute-Handlers< 0:1.01-474.module+el8.10.0+24099+8aa2f756

perl-autodie< 0:2.34-1.module+el8.10.0+21354+3ad137bb
perl-AutoLoader< 0:5.74-474.module+el8.10.0+24099+8aa2f756
perl-AutoSplit< 0:5.74-474.module+el8.10.0+24099+8aa2f756
perl-autouse< 0:1.11-474.module+el8.10.0+24099+8aa2f756
perl-B< 0:1.80-474.module+el8.10.0+24099+8aa2f756
perl-B-debuginfo< 0:1.80-474.module+el8.10.0+24099+8aa2f756
perl-base< 0:2.27-474.module+el8.10.0+24099+8aa2f756
perl-Benchmark< 0:1.23-474.module+el8.10.0+24099+8aa2f756
perl-bignum< 0:0.51-439.module+el8.10.0+21354+3ad137bb
perl-blib< 0:1.07-474.module+el8.10.0+24099+8aa2f756
perl-Carp< 0:1.50-439.module+el8.10.0+21354+3ad137bb
perl-Class-Struct< 0:0.66-474.module+el8.10.0+24099+8aa2f756
perl-Compress-Bzip2< 0:2.28-2.module+el8.10.0+21354+3ad137bb
perl-Compress-Bzip2-debuginfo< 0:2.28-2.module+el8.10.0+21354+3ad137bb
perl-Compress-Bzip2-debugsource< 0:2.28-2.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Bzip2< 0:2.096-1.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Bzip2-debuginfo< 0:2.096-1.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Bzip2-debugsource< 0:2.096-1.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Lzma< 0:2.096-1.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Lzma-debuginfo< 0:2.096-1.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Lzma-debugsource< 0:2.096-1.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Zlib< 0:2.096-2.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Zlib-debuginfo< 0:2.096-2.module+el8.10.0+21354+3ad137bb
perl-Compress-Raw-Zlib-debugsource< 0:2.096-2.module+el8.10.0+21354+3ad137bb
perl-Config-Extensions< 0:0.03-474.module+el8.10.0+24099+8aa2f756
perl-Config-Perl-V< 0:0.32-441.module+el8.10.0+21354+3ad137bb
perl-constant< 0:1.33-1001.module+el8.10.0+21354+3ad137bb
perl-CPAN< 0:2.28-5.module+el8.10.0+21354+3ad137bb
perl-CPAN-DistnameInfo< 0:0.12-13.module+el8.10.0+21354+3ad137bb
perl-CPAN-Meta< 0:2.150010-397.module+el8.10.0+21354+3ad137bb
perl-CPAN-Meta-Requirements< 0:2.140-397.module+el8.10.0+21354+3ad137bb
perl-CPAN-Meta-YAML< 0:0.018-1001.module+el8.10.0+21354+3ad137bb
perl-Data-Dumper< 0:2.174-440.module+el8.10.0+21354+3ad137bb
perl-Data-Dumper-debuginfo< 0:2.174-440.module+el8.10.0+21354+3ad137bb
perl-Data-Dumper-debugsource< 0:2.174-440.module+el8.10.0+21354+3ad137bb
perl-Data-OptList< 0:0.110-7.module+el8.10.0+21354+3ad137bb
perl-Data-Section< 0:0.200007-8.module+el8.10.0+21354+3ad137bb
perl-DB_File< 0:1.855-1.module+el8.10.0+21354+3ad137bb
perl-DB_File-debuginfo< 0:1.855-1.module+el8.10.0+21354+3ad137bb
perl-DB_File-debugsource< 0:1.855-1.module+el8.10.0+21354+3ad137bb
perl-DBM_Filter< 0:0.06-474.module+el8.10.0+24099+8aa2f756
perl-debugger< 0:1.56-474.module+el8.10.0+24099+8aa2f756
perl-debuginfo< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-debugsource< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-deprecate< 0:0.04-474.module+el8.10.0+24099+8aa2f756
perl-devel< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-Devel-Peek< 0:1.28-474.module+el8.10.0+24099+8aa2f756
perl-Devel-Peek-debuginfo< 0:1.28-474.module+el8.10.0+24099+8aa2f756
perl-Devel-PPPort< 0:3.62-1.module+el8.10.0+21354+3ad137bb
perl-Devel-PPPort-debuginfo< 0:3.62-1.module+el8.10.0+21354+3ad137bb
perl-Devel-PPPort-debugsource< 0:3.62-1.module+el8.10.0+21354+3ad137bb
perl-Devel-SelfStubber< 0:1.06-474.module+el8.10.0+24099+8aa2f756
perl-Devel-Size< 0:0.83-3.module+el8.10.0+21354+3ad137bb
perl-Devel-Size-debuginfo< 0:0.83-3.module+el8.10.0+21354+3ad137bb
perl-Devel-Size-debugsource< 0:0.83-3.module+el8.10.0+21354+3ad137bb
perl-diagnostics< 0:1.37-474.module+el8.10.0+24099+8aa2f756
perl-Digest< 0:1.20-1.module+el8.10.0+21354+3ad137bb
perl-Digest-MD5< 0:2.58-1.module+el8.10.0+21354+3ad137bb
perl-Digest-MD5-debuginfo< 0:2.58-1.module+el8.10.0+21354+3ad137bb
perl-Digest-MD5-debugsource< 0:2.58-1.module+el8.10.0+21354+3ad137bb
perl-Digest-SHA< 1:6.02-2.module+el8.10.0+21354+3ad137bb
perl-Digest-SHA-debuginfo< 1:6.02-2.module+el8.10.0+21354+3ad137bb
perl-Digest-SHA-debugsource< 1:6.02-2.module+el8.10.0+21354+3ad137bb
perl-DirHandle< 0:1.05-474.module+el8.10.0+24099+8aa2f756
perl-doc< 0:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-Dumpvalue< 0:2.27-474.module+el8.10.0+24099+8aa2f756
perl-DynaLoader< 0:1.47-474.module+el8.10.0+24099+8aa2f756
perl-DynaLoader-debuginfo< 0:1.47-474.module+el8.10.0+24099+8aa2f756
perl-Encode< 4:3.08-461.module+el8.10.0+21354+3ad137bb
perl-Encode-debuginfo< 4:3.08-461.module+el8.10.0+21354+3ad137bb
perl-Encode-debugsource< 4:3.08-461.module+el8.10.0+21354+3ad137bb
perl-Encode-devel< 4:3.08-461.module+el8.10.0+21354+3ad137bb
perl-Encode-Locale< 0:1.05-10.module+el8.10.0+21354+3ad137bb
perl-encoding< 4:3.00-461.module+el8.10.0+21354+3ad137bb
perl-encoding-warnings< 0:0.13-474.module+el8.10.0+24099+8aa2f756
perl-English< 0:1.11-474.module+el8.10.0+24099+8aa2f756
perl-Env< 0:1.04-396.module+el8.10.0+21354+3ad137bb
perl-Errno< 0:1.30-474.module+el8.10.0+24099+8aa2f756
perl-experimental< 0:0.025-1.module+el8.10.0+21354+3ad137bb
perl-Exporter< 0:5.74-458.module+el8.10.0+21354+3ad137bb
perl-ExtUtils-CBuilder< 1:0.280236-1.module+el8.10.0+21354+3ad137bb
perl-ExtUtils-Command< 2:7.46-3.module+el8.10.0+21354+3ad137bb
perl-ExtUtils-Constant< 0:0.25-474.module+el8.10.0+24099+8aa2f756
perl-ExtUtils-Embed< 0:1.35-474.module+el8.10.0+24099+8aa2f756
perl-ExtUtils-Install< 0:2.20-1.module+el8.10.0+21354+3ad137bb
perl-ExtUtils-MakeMaker< 2:7.46-3.module+el8.10.0+21354+3ad137bb
perl-ExtUtils-Manifest< 1:1.73-1.module+el8.10.0+21354+3ad137bb
perl-ExtUtils-Miniperl< 0:1.09-474.module+el8.10.0+24099+8aa2f756
perl-ExtUtils-MM-Utils< 2:7.46-3.module+el8.10.0+21354+3ad137bb
perl-ExtUtils-ParseXS< 1:3.40-439.module+el8.10.0+21354+3ad137bb
perl-Fcntl< 0:1.13-474.module+el8.10.0+24099+8aa2f756
perl-Fcntl-debuginfo< 0:1.13-474.module+el8.10.0+24099+8aa2f756
perl-Fedora-VSP< 0:0.001-10.module+el8.10.0+21354+3ad137bb
perl-fields< 0:2.27-474.module+el8.10.0+24099+8aa2f756
perl-File-Basename< 0:2.85-474.module+el8.10.0+24099+8aa2f756
perl-File-Compare< 0:1.100.600-474.module+el8.10.0+24099+8aa2f756
perl-File-Copy< 0:2.34-474.module+el8.10.0+24099+8aa2f756
perl-File-DosGlob< 0:1.12-474.module+el8.10.0+24099+8aa2f756
perl-File-DosGlob-debuginfo< 0:1.12-474.module+el8.10.0+24099+8aa2f756
perl-File-Fetch< 0:1.00-1.module+el8.10.0+21354+3ad137bb
perl-File-Find< 0:1.37-474.module+el8.10.0+24099+8aa2f756
perl-File-HomeDir< 0:1.004-6.module+el8.10.0+21354+3ad137bb
perl-File-Path< 0:2.16-439.module+el8.10.0+21354+3ad137bb
perl-File-stat< 0:1.09-474.module+el8.10.0+24099+8aa2f756
perl-File-Temp< 1:0.231.100-1.module+el8.10.0+21354+3ad137bb
perl-File-Which< 0:1.23-4.module+el8.10.0+21354+3ad137bb
perl-FileCache< 0:1.10-474.module+el8.10.0+24099+8aa2f756
perl-FileHandle< 0:2.03-474.module+el8.10.0+24099+8aa2f756
perl-filetest< 0:1.03-474.module+el8.10.0+24099+8aa2f756
perl-Filter< 2:1.60-1.module+el8.10.0+21354+3ad137bb
perl-Filter-debuginfo< 2:1.60-1.module+el8.10.0+21354+3ad137bb
perl-Filter-debugsource< 2:1.60-1.module+el8.10.0+21354+3ad137bb
perl-Filter-Simple< 0:0.96-457.module+el8.10.0+21354+3ad137bb
perl-FindBin< 0:1.51-474.module+el8.10.0+24099+8aa2f756
perl-GDBM_File< 0:1.18-474.module+el8.10.0+24099+8aa2f756
perl-GDBM_File-debuginfo< 0:1.18-474.module+el8.10.0+24099+8aa2f756
perl-generators< 0:1.13-1.module+el8.10.0+21354+3ad137bb
perl-Getopt-Long< 1:2.52-1.module+el8.10.0+21354+3ad137bb
perl-Getopt-Std< 0:1.12-474.module+el8.10.0+24099+8aa2f756
perl-Hash-Util< 0:0.23-474.module+el8.10.0+24099+8aa2f756
perl-Hash-Util-debuginfo< 0:0.23-474.module+el8.10.0+24099+8aa2f756
perl-Hash-Util-FieldHash< 0:1.20-474.module+el8.10.0+24099+8aa2f756
perl-Hash-Util-FieldHash-debuginfo< 0:1.20-474.module+el8.10.0+24099+8aa2f756
perl-homedir< 0:2.000024-7.module+el8.10.0+21354+3ad137bb
perl-HTTP-Tiny< 0:0.078-1.module+el8.10.0+21354+3ad137bb
perl-I18N-Collate< 0:1.02-474.module+el8.10.0+24099+8aa2f756
perl-I18N-Langinfo< 0:0.19-474.module+el8.10.0+24099+8aa2f756
perl-I18N-Langinfo-debuginfo< 0:0.19-474.module+el8.10.0+24099+8aa2f756
perl-I18N-LangTags< 0:0.44-474.module+el8.10.0+24099+8aa2f756
perl-if< 0:0.60.800-474.module+el8.10.0+24099+8aa2f756
perl-Importer< 0:0.025-6.module+el8.10.0+21354+3ad137bb
perl-inc-latest< 2:0.500-10.module+el8.10.0+21354+3ad137bb
perl-interpreter< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-interpreter-debuginfo< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-IO< 0:1.43-474.module+el8.10.0+24099+8aa2f756
perl-IO-Compress< 0:2.096-2.module+el8.10.0+24402+ce90c7a0
perl-IO-Compress-Lzma< 0:2.096-1.module+el8.10.0+21354+3ad137bb
perl-IO-debuginfo< 0:1.43-474.module+el8.10.0+24099+8aa2f756
perl-IO-Socket-IP< 0:0.41-2.module+el8.10.0+21354+3ad137bb
perl-IO-Zlib< 1:1.10-474.module+el8.10.0+24099+8aa2f756
perl-IPC-Cmd< 2:1.04-2.module+el8.10.0+21354+3ad137bb
perl-IPC-Open3< 0:1.21-474.module+el8.10.0+24099+8aa2f756
perl-IPC-System-Simple< 0:1.30-3.module+el8.10.0+21354+3ad137bb
perl-IPC-SysV< 0:2.09-1.module+el8.10.0+21354+3ad137bb
perl-IPC-SysV-debuginfo< 0:2.09-1.module+el8.10.0+21354+3ad137bb
perl-IPC-SysV-debugsource< 0:2.09-1.module+el8.10.0+21354+3ad137bb
perl-JSON-PP< 1:4.04-2.module+el8.10.0+21354+3ad137bb
perl-less< 0:0.03-474.module+el8.10.0+24099+8aa2f756
perl-lib< 0:0.65-474.module+el8.10.0+24099+8aa2f756
perl-libnet< 0:3.13-1.module+el8.10.0+21354+3ad137bb
perl-libnetcfg< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-libs< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-libs-debuginfo< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-local-lib< 0:2.000024-7.module+el8.10.0+21354+3ad137bb
perl-locale< 0:1.09-474.module+el8.10.0+24099+8aa2f756
perl-Locale-Maketext< 0:1.29-440.module+el8.10.0+21354+3ad137bb
perl-Locale-Maketext-Simple< 1:0.21-474.module+el8.10.0+24099+8aa2f756
perl-macros< 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-Math-BigInt< 1:1.9998.18-1.module+el8.10.0+21354+3ad137bb
perl-Math-BigInt-FastCalc< 0:0.500.900-1.module+el8.10.0+21354+3ad137bb
perl-Math-BigInt-FastCalc-debuginfo< 0:0.500.900-1.module+el8.10.0+21354+3ad137bb
perl-Math-BigInt-FastCalc-debugsource< 0:0.500.900-1.module+el8.10.0+21354+3ad137bb
perl-Math-BigRat< 0:0.2614-2.module+el8.10.0+21354+3ad137bb
perl-Math-Complex< 0:1.59-474.module+el8.10.0+24099+8aa2f756
perl-Memoize< 0:1.03-474.module+el8.10.0+24099+8aa2f756
perl-meta-notation< 0:5.32.1-474.module+el8.10.0+24099+8aa2f756
perl-MIME-Base64< 0:3.15-1001.module+el8.10.0+21354+3ad137bb
perl-MIME-Base64-debuginfo< 0:3.15-1001.module+el8.10.0+21354+3ad137bb
perl-MIME-Base64-debugsource< 0:3.15-1001.module+el8.10.0+21354+3ad137bb
perl-Module-Build< 2:0.42.31-5.module+el8.10.0+21354+3ad137bb
perl-Module-CoreList< 1:5.20211020-1.module+el8.10.0+21354+3ad137bb
perl-Module-CoreList-tools< 1:5.20211020-1.module+el8.10.0+21354+3ad137bb
perl-Module-Load< 1:0.36-1.module+el8.10.0+21354+3ad137bb
perl-Module-Load-Conditional< 0:0.74-1.module+el8.10.0+21354+3ad137bb
perl-Module-Loaded< 1:0.08-474.module+el8.10.0+24099+8aa2f756
perl-Module-Metadata< 0:1.000037-1.module+el8.10.0+21354+3ad137bb
perl-mro< 0:1.23-474.module+el8.10.0+24099+8aa2f756
perl-MRO-Compat< 0:0.13-5.module+el8.10.0+21354+3ad137bb
perl-mro-debuginfo< 0:1.23-474.module+el8.10.0+24099+8aa2f756
perl-NDBM_File< 0:1.15-474.module+el8.10.0+24099+8aa2f756
perl-NDBM_File-debuginfo< 0:1.15-474.module+el8.10.0+24099+8aa2f756
perl-Net< 0:1.02-474.module+el8.10.0+24099+8aa2f756
perl-Net-Ping< 0:2.72-474.module+el8.10.0+24099+8aa2f756
perl-NEXT< 0:0.67-474.module+el8.10.0+24099+8aa2f756
perl-Object-HashBase< 0:0.009-4.module+el8.10.0+21354+3ad137bb
perl-Object-HashBase-tools< 0:0.009-4.module+el8.10.0+21354+3ad137bb
perl-ODBM_File< 0:1.16-474.module+el8.10.0+24099+8aa2f756
perl-ODBM_File-debuginfo< 0:1.16-474.module+el8.10.0+24099+8aa2f756
perl-Opcode< 0:1.48-474.module+el8.10.0+24099+8aa2f756
perl-Opcode-debuginfo< 0:1.48-474.module+el8.10.0+24099+8aa2f756
perl-open< 0:1.12-474.module+el8.10.0+24099+8aa2f756
perl-overload< 0:1.31-474.module+el8.10.0+24099+8aa2f756

Show all 197

Bingos1 product

archive::tar< 3.10

Debian1 product

perlAll versions (No fix recorded) | < 5.42.3-1

Ubuntu1 product

perlAll versions (No fix recorded) | < 5.38.2-3.2ubuntu0.4

4 vendors · 200 products · Showing 200 of 300. Use Open JSON for the complete list.

References

20 links

github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patchPatchARTICLEREPORT
metacpan.org/release/BINGOS/Archive-Tar-3.10/changesRelease NotesARTICLEREPORT
www.openwall.com/lists/oss-security/2026/05/26/4REPORTMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2026:48225Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2481315REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48225.jsonAdvisory
access.redhat.com/security/cve/CVE-2026-9538REPORT
www.cve.org/CVERecord?id=CVE-2026-9538AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-9538Advisory

Show all 20 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities