tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade buildahUpgrade golang-miscUpgrade podman-dockerUpgrade golang-raceUpgrade golang-testsUpgrade golang-binUpgrade skopeoUpgrade buildah-testsUpgrade golang-docsUpgrade podman-testsUpgrade podman-remoteUpgrade golangUpgrade podmanUpgrade grafana-selinuxUpgrade grafanaUpgrade osbuild-composer-coreUpgrade image-builderUpgrade osbuild-composer-workerUpgrade go-toolsetUpgrade osbuild-composerUpgrade golang-srcUpgrade podman-pluginsUpgrade delveUpgrade skopeo-tests | Nov 21, 2025 | Nov 20, 2025 |
| Alpine Linux | — | Upgrade go | Oct 31, 2025 | Oct 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade cri-tools-debuginfoUpgrade rcloneUpgrade golang-miscUpgrade golang-testsUpgrade golangUpgrade golang-docsUpgrade cni-pluginsUpgrade runcUpgrade dockerUpgrade golang-binUpgrade nerdctlUpgrade runfinch-finchUpgrade containerd-stressUpgrade amazon-ecr-credential-helper-debuginfoUpgrade cni-plugins-debuginfoUpgrade amazon-ssm-agentUpgrade golistUpgrade containerdUpgrade oci-add-hooks-debuginfoUpgrade golang-sharedUpgrade ecs-initUpgrade rclone-debuginfoUpgrade soci-snapshotterUpgrade nerdctl-debuginfoUpgrade containerd-debuginfoUpgrade oci-add-hooksUpgrade amazon-ecr-credential-helperUpgrade runc-debuginfoUpgrade docker-debuginfoUpgrade golist-debuginfoUpgrade golang-srcUpgrade amazon-cloudwatch-agentUpgrade cri-tools | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade containerd-stress-debuginfoUpgrade runfinch-finchUpgrade docker-debugsourceUpgrade golang-srcUpgrade containerd-stressUpgrade golang-sharedUpgrade golangUpgrade docker-debuginfoUpgrade libcap-debugsourceUpgrade amazon-cloudwatch-agentUpgrade libcap-debuginfoUpgrade amazon-ecr-credential-helperUpgrade ecs-initUpgrade runcUpgrade runc-debuginfoUpgrade runc-debugsourceUpgrade cni-pluginsUpgrade golist-debuginfoUpgrade golang-docsUpgrade cni-plugins-debugsourceUpgrade cni-plugins-debuginfoUpgrade amazon-ssm-agentUpgrade nerdctlUpgrade oci-add-hooks-debuginfoUpgrade captree-debuginfoUpgrade golang-miscUpgrade libcapUpgrade golang-testsUpgrade oci-add-hooks-debugsourceUpgrade oci-add-hooksUpgrade libcap-staticUpgrade dockerUpgrade golang-binUpgrade golistUpgrade captreeUpgrade golist-debugsourceUpgrade containerd-debuginfoUpgrade soci-snapshotterUpgrade libcap-develUpgrade containerd-debugsourceUpgrade containerd | Oct 31, 2025 | Oct 29, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade osbuild-composer-coreUpgrade skopeoUpgrade podman-pluginsUpgrade criu-libsUpgrade osbuild-composerUpgrade skopeo-testsUpgrade delveUpgrade golang-binUpgrade python3-criuUpgrade image-builderUpgrade golang-srcUpgrade runcUpgrade criu-develUpgrade podmanUpgrade critUpgrade containers-commonUpgrade netavarkUpgrade podman-remoteUpgrade libslirp-develUpgrade oci-seccomp-bpf-hookUpgrade golang-miscUpgrade aardvark-dnsUpgrade containernetworking-pluginsUpgrade golang-testsUpgrade grafana-selinuxUpgrade golangUpgrade podman-catatonitUpgrade grafanaUpgrade fuse-overlayfsUpgrade podman-gvproxyUpgrade podman-dockerUpgrade golang-raceUpgrade go-toolsetUpgrade crunUpgrade container-selinuxUpgrade cockpit-podmanUpgrade buildah-testsUpgrade osbuild-composer-workerUpgrade podman-testsUpgrade golang-docsUpgrade conmonUpgrade libslirpUpgrade python3-podmanUpgrade criuUpgrade udicaUpgrade slirp4netnsUpgrade buildah | Nov 28, 2025 | Oct 29, 2025 |
| Redhat Openshift | — | Upgrade cri-oUpgrade openshiftUpgrade skopeoUpgrade podman | Aug 10, 2026 | Oct 29, 2025 |
| Redhat_linux | — | Upgrade osbuild-composer-coreUpgrade buildah-testsUpgrade conmon-debugsourceUpgrade criuUpgrade criu-libsUpgrade golang-raceUpgrade toolbox-testsUpgrade conmonUpgrade golang-testsUpgrade osbuild-composer-core-debuginfoUpgrade python3-podmanUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade buildahUpgrade crun-debuginfoUpgrade podman-catatonitUpgrade skopeo-debugsourceUpgrade delve-debuginfoUpgrade slirp4netnsUpgrade osbuild-composer-tests-debuginfoUpgrade libslirpUpgrade toolboxUpgrade delve-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade criu-debugsourceUpgrade podman-gvproxyUpgrade buildah-tests-debuginfoUpgrade cockpit-podmanUpgrade fuse-overlayfs-debuginfoUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade grafana-selinuxUpgrade skopeoUpgrade netavarkUpgrade libslirp-develUpgrade osbuild-composer-debuginfoUpgrade containers-commonUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade golang-miscUpgrade grafana-debuginfoUpgrade podmanUpgrade golang-srcUpgrade golangUpgrade image-builder-debugsourceUpgrade image-builderUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade toolbox-debuginfoUpgrade golang-docsUpgrade podman-debugsourceUpgrade toolbox-debugsourceUpgrade podman-tests-debuginfoUpgrade go-toolsetUpgrade podman-testsNo solution existsUpgrade osbuild-composer-workerUpgrade critUpgrade delveUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade criu-develUpgrade golang-binUpgrade podman-pluginsUpgrade containernetworking-plugins-debuginfoUpgrade grafana-debugsourceUpgrade slirp4netns-debuginfoUpgrade skopeo-testsUpgrade podman-dockerUpgrade osbuild-composer-debugsourceUpgrade osbuild-composerUpgrade image-builder-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade grafanaUpgrade udicaUpgrade runc-debuginfoUpgrade podman-plugins-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade buildah-debugsourceUpgrade container-selinuxUpgrade skopeo-debuginfoUpgrade python3-criuUpgrade osbuild-composer-worker-debuginfoUpgrade libslirp-debuginfoUpgrade podman-debuginfoUpgrade podman-remote-debuginfoUpgrade runcUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade crunUpgrade podman-gvproxy-debuginfoUpgrade criu-libs-debuginfo | Nov 21, 2025 | Oct 29, 2025 |
| Rocky_linux | — | Upgrade skopeo-debugsourceUpgrade delve-debuginfoUpgrade criu-debuginfoUpgrade netavarkUpgrade conmon-debuginfoUpgrade go-toolsetUpgrade criu-libs-debuginfoUpgrade buildahUpgrade crun-debuginfoUpgrade osbuild-composer-debuginfoUpgrade golangUpgrade toolbox-testsUpgrade python3-criuUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade osbuild-composer-core-debuginfoUpgrade image-builder-debugsourceUpgrade conmon-debugsourceUpgrade osbuild-composer-coreUpgrade podman-remoteUpgrade podman-plugins-debuginfoUpgrade podman-tests-debuginfoUpgrade podman-debuginfoUpgrade osbuild-composerUpgrade slirp4netnsUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfsUpgrade toolbox-debugsourceUpgrade criu-debugsourceUpgrade libslirp-debuginfoUpgrade skopeo-debuginfoUpgrade buildah-testsUpgrade grafana-debuginfoUpgrade criuUpgrade grafanaUpgrade buildah-debugsourceUpgrade containers-commonUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade delve-debugsourceUpgrade crunUpgrade runc-debuginfoUpgrade skopeoUpgrade podman-debugsourceUpgrade osbuild-composer-debugsourceUpgrade critUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade runcUpgrade libslirp-debugsourceUpgrade golang-raceUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade conmonUpgrade toolboxUpgrade podman-pluginsUpgrade osbuild-composer-worker-debuginfoUpgrade podman-testsUpgrade osbuild-composer-workerUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-testsUpgrade grafana-selinuxUpgrade libslirpUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-remote-debuginfoUpgrade golang-binUpgrade libslirp-develUpgrade image-builder-debuginfoUpgrade grafana-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade criu-develUpgrade podmanUpgrade image-builder | Feb 5, 2026 | Dec 23, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.8Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.2.12Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.3.9Upgrade Splunk Enterprise to version 10.0.3Upgrade Splunk Enterprise to version 9.4.9 | Jul 30, 2026 | Oct 29, 2025 |
| Suse | — | Upgrade go1.25-docUpgrade go1.24-raceUpgrade go1.25-raceUpgrade go1.24Upgrade go1.24-docUpgrade go1.25 | Dec 5, 2025 | Oct 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub