An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp10 | — | Upgrade libarchive | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libarchive | Mar 17, 2026 | Mar 16, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libarchive | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 5, 2025 |
| Ubuntu | — | Upgrade libarchive13 (Ubuntu Pro)Upgrade libarchive-tools (Ubuntu Pro)Upgrade libarchive-toolsUpgrade bsdcpio (Ubuntu Pro)Upgrade bsdtar (Ubuntu Pro)Upgrade libarchive13Upgrade libarchive-devUpgrade libarchive13t64Upgrade libarchive-dev (Ubuntu Pro) | Apr 7, 2026 | Apr 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 5, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub