tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-pluginsUpgrade go-toolsetUpgrade osbuild-composer-coreUpgrade skopeo-testsUpgrade osbuild-composer-workerUpgrade image-builderUpgrade delveUpgrade golang-srcUpgrade grafanaUpgrade osbuild-composerUpgrade grafana-selinuxUpgrade golang-miscUpgrade podman-dockerUpgrade golang-testsUpgrade golangUpgrade podmanUpgrade buildahUpgrade golang-docsUpgrade podman-remoteUpgrade buildah-testsUpgrade golang-raceUpgrade skopeoUpgrade podman-testsUpgrade golang-bin | Nov 21, 2025 | Nov 20, 2025 |
| Alpine Linux | — | Upgrade go | Oct 31, 2025 | Oct 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-binUpgrade amazon-ecr-credential-helper-debuginfoUpgrade golang-docsUpgrade containerd-stressUpgrade nerdctlUpgrade golang-testsUpgrade cni-pluginsUpgrade rcloneUpgrade dockerUpgrade golangUpgrade cri-tools-debuginfoUpgrade runfinch-finchUpgrade runcUpgrade golang-sharedUpgrade golistUpgrade docker-debuginfoUpgrade oci-add-hooksUpgrade amazon-ecr-credential-helperUpgrade ecs-initUpgrade oci-add-hooks-debuginfoUpgrade rclone-debuginfoUpgrade cri-toolsUpgrade amazon-cloudwatch-agentUpgrade containerdUpgrade golang-srcUpgrade golist-debuginfoUpgrade soci-snapshotterUpgrade nerdctl-debuginfoUpgrade containerd-debuginfoUpgrade runc-debuginfoUpgrade cni-plugins-debuginfoUpgrade amazon-ssm-agent | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade golang-miscUpgrade oci-add-hooksUpgrade containerdUpgrade libcap-develUpgrade containerd-debuginfoUpgrade soci-snapshotterUpgrade dockerUpgrade golang-binUpgrade libcap-staticUpgrade golang-testsUpgrade captreeUpgrade containerd-debugsourceUpgrade golist-debugsourceUpgrade libcapUpgrade oci-add-hooks-debugsourceUpgrade golistUpgrade cni-pluginsUpgrade oci-add-hooks-debuginfoUpgrade golang-sharedUpgrade docker-debuginfoUpgrade containerd-stressUpgrade amazon-ecr-credential-helperUpgrade runc-debugsourceUpgrade cni-plugins-debugsourceUpgrade golang-docsUpgrade cni-plugins-debuginfoUpgrade amazon-ssm-agentUpgrade nerdctlUpgrade libcap-debuginfoUpgrade golangUpgrade runcUpgrade libcap-debugsourceUpgrade runc-debuginfoUpgrade ecs-initUpgrade amazon-cloudwatch-agentUpgrade golang-srcUpgrade docker-debugsourceUpgrade containerd-stress-debuginfoUpgrade runfinch-finchUpgrade captree-debuginfoUpgrade golist-debuginfo | Oct 31, 2025 | Oct 29, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade grafana-selinuxUpgrade image-builderUpgrade oci-seccomp-bpf-hookUpgrade golang-testsUpgrade containers-commonUpgrade golang-binUpgrade golangUpgrade libslirp-develUpgrade podman-remoteUpgrade netavarkUpgrade containernetworking-pluginsUpgrade runcUpgrade skopeo-testsUpgrade skopeoUpgrade osbuild-composerUpgrade delveUpgrade criu-libsUpgrade podman-pluginsUpgrade osbuild-composer-coreUpgrade aardvark-dnsUpgrade critUpgrade golang-miscUpgrade podmanUpgrade golang-srcUpgrade python3-criuUpgrade criu-develUpgrade slirp4netnsUpgrade container-selinuxUpgrade golang-docsUpgrade udicaUpgrade criuUpgrade crunUpgrade buildah-testsUpgrade golang-raceUpgrade podman-gvproxyUpgrade podman-dockerUpgrade buildahUpgrade grafanaUpgrade go-toolsetUpgrade cockpit-podmanUpgrade podman-testsUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade libslirpUpgrade conmonUpgrade osbuild-composer-workerUpgrade python3-podman | Nov 28, 2025 | Oct 29, 2025 |
| Redhat Openshift | — | Upgrade cri-oUpgrade skopeoUpgrade openshiftUpgrade podman | Aug 10, 2026 | Oct 29, 2025 |
| Redhat_linux | — | Upgrade conmonUpgrade criu-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade delve-debugsourceUpgrade libslirpUpgrade golang-raceUpgrade osbuild-composer-tests-debuginfoUpgrade netavarkUpgrade grafana-selinuxUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade aardvark-dnsUpgrade golangUpgrade golang-srcUpgrade image-builderUpgrade image-builder-debugsourceUpgrade criuUpgrade runc-debugsourceUpgrade podman-catatonitUpgrade grafana-debuginfoUpgrade criu-debuginfoUpgrade podmanUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade buildahUpgrade fuse-overlayfsUpgrade osbuild-composer-core-debuginfoUpgrade golang-testsUpgrade buildah-debuginfoUpgrade crun-debuginfoUpgrade delve-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade libslirp-develUpgrade osbuild-composer-debuginfoUpgrade python3-podmanUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-debugsourceUpgrade skopeoUpgrade fuse-overlayfs-debugsourceUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade cockpit-podmanUpgrade golang-miscUpgrade slirp4netnsUpgrade criu-libsUpgrade toolboxUpgrade toolbox-testsUpgrade osbuild-composer-coreUpgrade buildah-testsUpgrade podman-debugsourceUpgrade osbuild-composer-debugsourceUpgrade criu-libs-debuginfoUpgrade slirp4netns-debugsourceUpgrade osbuild-composer-workerUpgrade grafanaUpgrade delveUpgrade toolbox-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debuginfoUpgrade podman-dockerUpgrade container-selinuxUpgrade podman-testsUpgrade go-toolsetUpgrade podman-remote-debuginfoUpgrade podman-tests-debuginfoNo solution existsUpgrade podman-pluginsUpgrade skopeo-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade libslirp-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade crunUpgrade runc-debuginfoUpgrade osbuild-composer-dnf-jsonUpgrade podman-plugins-debuginfoUpgrade udicaUpgrade buildah-debugsourceUpgrade golang-binUpgrade criu-develUpgrade critUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade libslirp-debugsourceUpgrade python3-criuUpgrade toolbox-debugsourceUpgrade image-builder-debuginfoUpgrade golang-docsUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade grafana-debugsourceUpgrade containernetworking-pluginsUpgrade osbuild-composer | Nov 21, 2025 | Oct 29, 2025 |
| Rocky_linux | — | Upgrade osbuild-composerUpgrade fuse-overlayfsUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade podman-remoteUpgrade fuse-overlayfs-debugsourceUpgrade image-builder-debugsourceUpgrade skopeo-debugsourceUpgrade conmon-debuginfoUpgrade podman-plugins-debuginfoUpgrade delve-debuginfoUpgrade go-toolsetUpgrade osbuild-composer-core-debuginfoUpgrade toolbox-debugsourceUpgrade podman-tests-debuginfoUpgrade python3-criuUpgrade conmon-debugsourceUpgrade golangUpgrade criu-libs-debuginfoUpgrade grafanaUpgrade buildah-testsUpgrade criuUpgrade buildahUpgrade grafana-debuginfoUpgrade libslirp-debuginfoUpgrade skopeo-debuginfoUpgrade runc-debugsourceUpgrade slirp4netnsUpgrade netavarkUpgrade aardvark-dnsUpgrade criu-debuginfoUpgrade podman-debuginfoUpgrade crun-debuginfoUpgrade osbuild-composer-coreUpgrade criu-debugsourceUpgrade osbuild-composer-debuginfoUpgrade toolbox-testsUpgrade toolbox-debuginfoUpgrade runcUpgrade criu-libsUpgrade podman-remote-debuginfoUpgrade image-builder-debuginfoUpgrade libslirp-develUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade critUpgrade golang-raceUpgrade grafana-debugsourceUpgrade golang-binUpgrade slirp4netns-debuginfoUpgrade containernetworking-pluginsUpgrade osbuild-composer-worker-debuginfoUpgrade conmonUpgrade toolboxUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade delveUpgrade crunUpgrade containernetworking-plugins-debugsourceUpgrade grafana-selinuxUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade skopeo-testsUpgrade containers-commonUpgrade libslirpUpgrade crun-debugsourceUpgrade podman-testsUpgrade runc-debuginfoUpgrade criu-develUpgrade podmanUpgrade image-builderUpgrade delve-debugsourceUpgrade osbuild-composer-workerUpgrade libslirp-debugsourceUpgrade skopeoUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade osbuild-composer-debugsource | Feb 5, 2026 | Dec 23, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.12Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.4.8Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.0.3Upgrade Splunk Enterprise to version 9.3.9Upgrade Splunk Enterprise to version 9.4.9 | Jul 30, 2026 | Oct 29, 2025 |
| Suse | — | Upgrade go1.25Upgrade go1.24-docUpgrade go1.24-raceUpgrade go1.24Upgrade go1.25-raceUpgrade go1.25-doc | Dec 5, 2025 | Oct 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub