tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-pluginsUpgrade osbuild-composerUpgrade delveUpgrade osbuild-composer-workerUpgrade grafanaUpgrade osbuild-composer-coreUpgrade go-toolsetUpgrade golang-srcUpgrade skopeo-testsUpgrade image-builderUpgrade golang-raceUpgrade golang-testsUpgrade grafana-selinuxUpgrade podmanUpgrade golang-docsUpgrade golang-binUpgrade podman-testsUpgrade golangUpgrade buildahUpgrade buildah-testsUpgrade golang-miscUpgrade podman-dockerUpgrade skopeoUpgrade podman-remote | Nov 21, 2025 | Nov 20, 2025 |
| Alpine Linux | — | Upgrade go | Oct 31, 2025 | Oct 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade cni-plugins-debuginfoUpgrade golist-debuginfoUpgrade amazon-ssm-agentUpgrade golang-srcUpgrade runc-debuginfoUpgrade amazon-cloudwatch-agentUpgrade containerdUpgrade cri-toolsUpgrade containerd-debuginfoUpgrade soci-snapshotterUpgrade nerdctl-debuginfoUpgrade golang-sharedUpgrade oci-add-hooks-debuginfoUpgrade rclone-debuginfoUpgrade ecs-initUpgrade golistUpgrade oci-add-hooksUpgrade amazon-ecr-credential-helperUpgrade docker-debuginfoUpgrade runcUpgrade golangUpgrade golang-testsUpgrade amazon-ecr-credential-helper-debuginfoUpgrade golang-miscUpgrade golang-binUpgrade golang-docsUpgrade cri-tools-debuginfoUpgrade nerdctlUpgrade runfinch-finchUpgrade rcloneUpgrade dockerUpgrade cni-pluginsUpgrade containerd-stress | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade amazon-ecr-credential-helperUpgrade cni-plugins-debuginfoUpgrade golang-docsUpgrade nerdctlUpgrade docker-debuginfoUpgrade runc-debuginfoUpgrade runfinch-finchUpgrade containerd-stress-debuginfoUpgrade golang-srcUpgrade docker-debugsourceUpgrade cni-plugins-debugsourceUpgrade oci-add-hooks-debuginfoUpgrade captree-debuginfoUpgrade amazon-cloudwatch-agentUpgrade cni-pluginsUpgrade libcap-debugsourceUpgrade runc-debugsourceUpgrade amazon-ssm-agentUpgrade golang-sharedUpgrade runcUpgrade ecs-initUpgrade golist-debuginfoUpgrade libcap-debuginfoUpgrade golangUpgrade containerd-stressUpgrade containerd-debugsourceUpgrade golist-debugsourceUpgrade containerd-debuginfoUpgrade dockerUpgrade golistUpgrade captreeUpgrade golang-binUpgrade containerdUpgrade golang-miscUpgrade oci-add-hooksUpgrade libcap-staticUpgrade soci-snapshotterUpgrade golang-testsUpgrade oci-add-hooks-debugsourceUpgrade libcapUpgrade libcap-devel | Oct 31, 2025 | Oct 29, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade crunUpgrade osbuild-composer-workerUpgrade container-selinuxUpgrade conmonUpgrade buildah-testsUpgrade grafanaUpgrade cockpit-podmanUpgrade slirp4netnsUpgrade podman-dockerUpgrade podman-gvproxyUpgrade golang-raceUpgrade podman-catatonitUpgrade golang-docsUpgrade buildahUpgrade go-toolsetUpgrade fuse-overlayfsUpgrade criuUpgrade python3-podmanUpgrade libslirpUpgrade udicaUpgrade podman-testsUpgrade skopeoUpgrade osbuild-composerUpgrade podman-pluginsUpgrade osbuild-composer-coreUpgrade golang-testsUpgrade runcUpgrade image-builderUpgrade critUpgrade podman-remoteUpgrade netavarkUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade golang-miscUpgrade aardvark-dnsUpgrade golangUpgrade containers-commonUpgrade golang-binUpgrade python3-criuUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade golang-srcUpgrade grafana-selinuxUpgrade criu-develUpgrade delveUpgrade criu-libsUpgrade skopeo-tests | Nov 28, 2025 | Oct 29, 2025 |
| Redhat Openshift | — | Upgrade cri-oUpgrade skopeoUpgrade openshiftUpgrade podman | Aug 10, 2026 | Oct 29, 2025 |
| Redhat_linux | — | Upgrade fuse-overlayfs-debugsourceUpgrade delve-debugsourceUpgrade libslirpUpgrade toolbox-testsUpgrade containernetworking-plugins-debugsourceUpgrade criuUpgrade conmonUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade aardvark-dnsUpgrade libslirp-develUpgrade golangUpgrade skopeoUpgrade osbuild-composer-debuginfoUpgrade netavarkUpgrade podman-catatonit-debuginfoUpgrade podman-catatonitUpgrade python3-podmanUpgrade delve-debuginfoUpgrade skopeo-debugsourceUpgrade golang-miscUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade image-builder-debugsourceUpgrade criu-debugsourceUpgrade runc-debugsourceUpgrade grafana-selinuxUpgrade grafana-debuginfoUpgrade podmanUpgrade crun-debugsourceUpgrade image-builderUpgrade criu-libsUpgrade golang-srcUpgrade conmon-debugsourceUpgrade buildah-tests-debuginfoUpgrade golang-raceUpgrade cockpit-podmanUpgrade osbuild-composer-tests-debuginfoUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade toolboxUpgrade golang-testsUpgrade osbuild-composer-core-debuginfoUpgrade criu-debuginfoUpgrade osbuild-composer-coreUpgrade crunUpgrade podman-testsUpgrade go-toolsetUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade libslirp-debugsourceUpgrade golang-binUpgrade podman-remote-debuginfoUpgrade conmon-debuginfoNo solution existsUpgrade critUpgrade criu-develUpgrade podman-tests-debuginfoUpgrade podman-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-dockerUpgrade osbuild-composer-debugsourceUpgrade osbuild-composerUpgrade grafana-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade image-builder-debuginfoUpgrade toolbox-debugsourceUpgrade podman-debugsourceUpgrade osbuild-composer-workerUpgrade grafanaUpgrade golang-docsUpgrade delveUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeo-testsUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade podman-pluginsUpgrade skopeo-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade podman-plugins-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade runc-debuginfoUpgrade buildah-debugsourceUpgrade podman-remoteUpgrade criu-libs-debuginfoUpgrade udicaUpgrade toolbox-debuginfo | Nov 21, 2025 | Oct 29, 2025 |
| Rocky_linux | — | Upgrade slirp4netnsUpgrade fuse-overlayfsUpgrade fuse-overlayfs-debugsourceUpgrade osbuild-composerUpgrade buildahUpgrade netavarkUpgrade go-toolsetUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade criu-debugsourceUpgrade toolbox-testsUpgrade delve-debuginfoUpgrade python3-criuUpgrade aardvark-dnsUpgrade osbuild-composer-debuginfoUpgrade podman-remoteUpgrade osbuild-composer-coreUpgrade runc-debugsourceUpgrade image-builder-debugsourceUpgrade crun-debuginfoUpgrade podman-debuginfoUpgrade toolbox-debugsourceUpgrade golangUpgrade criu-libs-debuginfoUpgrade criuUpgrade grafanaUpgrade osbuild-composer-core-debuginfoUpgrade buildah-testsUpgrade podman-tests-debuginfoUpgrade podman-plugins-debuginfoUpgrade conmon-debugsourceUpgrade skopeo-debuginfoUpgrade libslirp-debuginfoUpgrade skopeo-debugsourceUpgrade criu-debuginfoUpgrade grafana-debuginfoUpgrade conmon-debuginfoUpgrade libslirp-debugsourceUpgrade grafana-debugsourceUpgrade podman-pluginsUpgrade toolbox-debuginfoUpgrade golang-raceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade grafana-selinuxUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-testsUpgrade image-builder-debuginfoUpgrade golang-binUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade podmanUpgrade runc-debuginfoUpgrade delve-debugsourceUpgrade criu-develUpgrade containers-commonUpgrade podman-testsUpgrade osbuild-composer-workerUpgrade crun-debugsourceUpgrade image-builderUpgrade conmonUpgrade toolboxUpgrade osbuild-composer-worker-debuginfoUpgrade containernetworking-pluginsUpgrade delveUpgrade oci-seccomp-bpf-hookUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-develUpgrade slirp4netns-debugsourceUpgrade osbuild-composer-debugsourceUpgrade skopeoUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade podman-debugsourceUpgrade criu-libsUpgrade critUpgrade runcUpgrade oci-seccomp-bpf-hook-debugsource | Feb 5, 2026 | Dec 23, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.9Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.0.3Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.4.8Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.2.12 | Jul 30, 2026 | Oct 29, 2025 |
| Suse | — | Upgrade go1.25-docUpgrade go1.24Upgrade go1.24-raceUpgrade go1.25-raceUpgrade go1.24-docUpgrade go1.25 | Dec 5, 2025 | Oct 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub