Red Hat CVE-2026-32288

The Go standard library's archive/tar package implements parsing of the tar archive format, including support for the GNU sparse file extension. The old GNU sparse map format encodes information about sparse regions (gaps in file content) within tar headers. The vulnerability exists in the tar.Reader component when it processes sparse region metadata without properly validating or limiting the number of sparse regions that can be allocated in memory. CWE classification not provided in source data, but the root cause is an unbounded resource allocation vulnerability in archive parsing. CPE cpe:2.3:a:go_standard_library:archive/tar:*:*:*:*:*:*:*:* covers all versions of this standard library component across all product variants.