CVE Catalog
CVE-2026-32288
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk0.29%
21th percentile - higher than 21% of all known CVEs
Summary
The tar.Reader function in Go can allocate an unbounded amount of memory when reading a maliciously crafted archive containing a large number of sparse regions encoded in the 'old GNU sparse map' format.
Risk Assessment
An attacker can cause memory exhaustion (DoS) by providing a specially crafted tar archive to an application using tar.Reader.
Recommendation
Update the Go package to a version that limits memory allocation when processing sparse maps in tar archives.
Original NVD description (English source)
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.