tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade goUpgrade rclone | Apr 13, 2026 | Apr 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade nerdctlUpgrade containerdUpgrade amazon-cloudwatch-agentUpgrade oci-add-hooks-debuginfoUpgrade containerd-stressUpgrade runcUpgrade ecs-initUpgrade golang-binUpgrade containerd-debuginfoUpgrade golang-testsUpgrade nerdctl-debuginfoUpgrade golang-sharedUpgrade amazon-ecr-credential-helper-debuginfoUpgrade docker-debuginfoUpgrade runc-debuginfoUpgrade golist-debuginfoUpgrade golangUpgrade oci-add-hooksUpgrade amazon-ecr-credential-helperUpgrade golang-srcUpgrade soci-snapshotterUpgrade dockerUpgrade golang-miscUpgrade runfinch-finchUpgrade golist | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade yqUpgrade containerd-debugsourceUpgrade golang-binUpgrade golang-docsUpgrade golang-miscUpgrade oci-add-hooks-debugsourceUpgrade golangUpgrade containerd-stressUpgrade dockerUpgrade golang-testsUpgrade runcUpgrade soci-snapshotterUpgrade golist-debugsourceUpgrade golang-sharedUpgrade amazon-cloudwatch-agentUpgrade golist-debuginfoUpgrade runc-debugsourceUpgrade yq-debuginfoUpgrade containerd-debuginfoUpgrade docker-debuginfoUpgrade yq-debugsourceUpgrade runfinch-finchUpgrade containerd-stress-debuginfoUpgrade amazon-ecr-credential-helperUpgrade nerdctlUpgrade docker-debugsourceUpgrade golistUpgrade credentials-fetcherUpgrade containerdUpgrade oci-add-hooks-debuginfoUpgrade golang-srcUpgrade ecs-initUpgrade oci-add-hooksUpgrade runc-debuginfo | May 4, 2026 | Apr 8, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Apr 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub