Skip to main content

Archive Tar CVE-2026-32288

| EUVDEUVD-2026-20016 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-04-08 Go GHSA-x4jj-h2v8-hqqv
Denial Of Service Archive Tar Go Standard Library
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Attacker creates malicious tar archive with excessive sparse regions
  2. Delivery
    Delivers file to target via social engineering or supply chain
  3. Exploit
    User opens/extracts archive with vulnerable Go application
  4. Install
    tar.Reader parses old GNU sparse map format
  5. C2
    Unbounded memory allocation for sparse region metadata
  6. Execute
    System memory exhaustion
  7. Impact
    Application denial of service

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The vulnerability requires processing of a tar archive specifically crafted with large numbers of sparse regions in the old GNU sparse map format via Go's archive/tar package. The attacker must successfully deliver the malicious tar file to the target system and trigger its processing by the vulnerable application, typically requiring user interaction to open, extract, or validate the archive. No network attack path exists; the attack is strictly local and requires user action to load the malicious file.
Impact

CVSS 5.5 (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with user interaction required, no special privileges needed, resulting in high availability impact with no confidentiality or integrity compromise. However, the EPSS score of 0.01% (1st percentile) reflects extremely low real-world exploitation probability, suggesting this vulnerability has minimal practical impact despite the moderate CVSS rating. The local-only attack vector and user interaction requirement significantly constrain exploitability compared to network-accessible vulnerabilities. KEV status not confirmed, and no public exploit code exists. SSVC analysis: exploitation is unproven/limited, not automatable (requires crafted file + user action to process), and causes denial of service with high technical impact. Priority should be lower than CVSS alone suggests due to environmental factors (local + interaction) and minimal POC ecosystem.
Exploit ScenarioDerived

An attacker crafts a malicious tar archive with an exceptionally large number of sparse regions encoded in old GNU sparse map format and distributes it (e.g., via download link, attachment, or repository). When a user or automated process extracts or inspects the archive using a Go application with vulnerable archive/tar, the tar.Reader allocates unbounded memory proportional to the number of sparse regions, exhausting available RAM and causing the application to crash or the system to become unresponsive. No sophisticated exploitation technique is required beyond malicious file creation and social engineering or supply chain compromise to deliver the file.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 15, 2026

Denial of service via unbounded memory allocation in Go's archive/tar package when parsing maliciously-crafted tar archives containing many sparse regions in old GNU sparse map format. Affects Go standard library versions prior to 1.25.9 and 1.26.2. Local attackers with user interaction can exhaust system memory, crashing applications that process untrusted tar files. No public exploit code identified; EPSS score of 0.01% indicates very low exploitation probability despite moderate CVSS severity.

RemediationAI

Upgrade to Go 1.25.9 or later, or Go 1.26.2 or later, depending on the release branch in use. These patched versions include the fix committed in go.dev/cl/763766. For applications unable to immediately upgrade, implement validation of tar archives from untrusted sources by limiting file processing or sandboxing tar extraction operations. Review upstream advisories at https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU and https://pkg.go.dev/vuln/GO-2026-4869 for comprehensive patching guidance and any additional mitigations.

Affected VersionsENISA

archive/tar 1.26.0-0 <1.26.2
archive/tar 0 <1.25.9

Affected Packages

go stdlib fix: 1.25.9, 1.26.2
euvd archive_tar fix: 1.25.9, 1.26.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Go standard library's archive/tar package implements parsing of the tar archive format, including support for the GNU sparse file extension. The old GNU sparse map format encodes information about sparse regions (gaps in file content) within tar headers. The vulnerability exists in the tar.Reader component when it processes sparse region metadata without properly validating or limiting the number of sparse regions that can be allocated in memory. CWE classification not provided in source data, but the root cause is an unbounded resource allocation vulnerability in archive parsing. CPE cpe:2.3:a:go_standard_library:archive/tar:*:*:*:*:*:*:*:* covers all versions of this standard library component across all product variants.

Know when Archive Tar gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 4.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Apr 13, 2026 - 19:37 NVD
5.5 (MEDIUM)
Patch released
Apr 08, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 08, 2026 - 01:06 nvd
N/A

DescriptionNVD

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Archive Tar

View all
CVE-2020-28949 HIGH POC
7.8 Nov 19

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper
CVE-2020-28948 HIGH POC
7.8 Nov 19

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. Rated hig
CVE-2021-32610 HIGH
7.1 Jul 30

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-32288 ADVISORY https://vuldb.com/vuln/355986 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1320/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1321/ REF https://go.dev/cl/763766 REF https://go.dev/issue/78301 REF https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU REF https://pkg.go.dev/vuln/GO-2026-4869

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy