CVE-2026-9538
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In the Archive::Tar library for Perl versions before 3.10, memory exhaustion is possible via an attacker-controlled entry size field in the tar header. The _read_tar() function allocates a scalar based on the header size without an upper bound.
Risk Assessment
An attacker can remotely exhaust memory of a Perl process by sending a crafted tar archive with a giant entry size, leading to DoS attacks.
Recommendation
Update the Archive::Tar library to version 3.10 or later, which includes a fix to limit allocation size.
Other vulnerabilities in Archive::Tar
See all- CVE-2026-42496Critical
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path.
- CVE-2026-42497High
A vulnerability in Archive::Tar for Perl before version 3.08 allows extraction of hardlinks to attacker-controlled paths outside the extraction directory. The _make_special_file() function passes the tar header's linkname to link() without validating absolute paths or '..' segments, creating a hardlink to the victim file. A subsequent write through the extracted name modifies the victim file, and the _extract_file() block (guarded only against symlinks) applies permissions, owner, and timestamps to the shared inode.
Original NVD description (English source)
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.