tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade goUpgrade rclone | Apr 13, 2026 | Apr 8, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golistUpgrade dockerUpgrade golang-srcUpgrade golangUpgrade runfinch-finchUpgrade soci-snapshotterUpgrade runc-debuginfoUpgrade docker-debuginfoUpgrade oci-add-hooksUpgrade golist-debuginfoUpgrade amazon-ecr-credential-helperUpgrade golang-binUpgrade amazon-cloudwatch-agentUpgrade amazon-ecr-credential-helper-debuginfoUpgrade containerd-stressUpgrade ecs-initUpgrade nerdctl-debuginfoUpgrade golang-docsUpgrade containerdUpgrade oci-add-hooks-debuginfoUpgrade nerdctlUpgrade containerd-debuginfoUpgrade runcUpgrade golang-testsUpgrade golang-shared | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golang-miscUpgrade golang-binUpgrade oci-add-hooks-debugsourceUpgrade dockerUpgrade runcUpgrade golist-debugsourceUpgrade soci-snapshotterUpgrade containerd-debugsourceUpgrade golang-testsUpgrade containerd-stressUpgrade golangUpgrade yqUpgrade golang-sharedUpgrade yq-debugsourceUpgrade runfinch-finchUpgrade amazon-ecr-credential-helperUpgrade containerd-debuginfoUpgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade docker-debuginfoUpgrade containerd-stress-debuginfoUpgrade golist-debuginfoUpgrade docker-debugsourceUpgrade golang-srcUpgrade oci-add-hooks-debuginfoUpgrade credentials-fetcherUpgrade containerdUpgrade oci-add-hooksUpgrade golistUpgrade ecs-initUpgrade yq-debuginfoUpgrade runc-debugsourceUpgrade runc-debuginfo | May 4, 2026 | Apr 8, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Apr 8, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 8, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub