CVE-2021-20193

LowCVSS 3.3

Published: 26/03/2021(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.09%

64th percentile - higher than 64% of all known CVEs

Summary

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.

Risk Assessment

Denial of service via uncontrolled memory consumption, potentially leading to system crashes or service unavailability.

Recommendation

Upgrade tar to version 1.34 or later. Restrict the ability to submit files to tar to trusted users only.

Other vulnerabilities in tar

CVE-2026-5704Medium
A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS