Archive::Tar CVE-2026-9538

Exploitation requires that a target application uses Archive::Tar before 3.10 to read or extract a tar archive that the attacker can supply; the malicious archive simply needs one entry header declaring a size large enough to trigger an outsized allocation. Per the CVSS vector (PR:N, UI:N, AC:L) no authentication, no user interaction, and no special non-default configuration are needed - pre-3.10 versions had no size cap by default, so default installations are affected. The key limiting factors are scope and impact rather than prerequisites: the attacker must have a path to feed an untrusted tarball into the parser, and the outcome is availability loss (denial of service) only - there is no code execution, file write, or data disclosure from this issue.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a low-effort, network-reachable, unauthenticated condition with availability-only impact - i.e., a denial of service, not code execution or data exposure. That high base score is tempered by a very low EPSS of 0.02% (4th percentile), no CISA KEV listing, and no known public exploit, indicating little real-world exploitation pressure. Realistic priority is moderate-to-low and is gated by whether a given application feeds attacker-supplied archives into Archive::Tar; the 'AV:N' rating presumes that reachability. Note a data conflict: the intelligence Tags label this 'Information Disclosure,' which contradicts the CVSS vector (C:N/I:N/A:H) and CWE-789 - the impact is memory exhaustion/availability, so the tag appears mislabeled and should not be relied upon. Additionally, the source description text is garbled and conflates three separate Archive::Tar advisories (symlink extraction, hardlink CVE-2026-42497, and this memory-exhaustion issue); this analysis is scoped to CVE-2026-9538 only.

An attacker crafts a tar archive containing an entry whose header size field declares an enormous value and uploads or submits it to a service that parses tarballs with Archive::Tar (for example a file-upload, backup, or package-processing endpoint). When the module reads the archive it attempts to allocate based on the declared size, exhausting available memory and crashing or hanging the process. No public proof-of-concept is identified at time of analysis, and exploitation requires no authentication or user interaction given the low-complexity network vector.