Skip to content
Sign in
Not rated

CVE-2022-2879 Reader.Read does not set a limit on the maximum size of file headers

Description

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

Affected products and versions

Product Affected versions Fixed in
archive/tar 1.19 1.19.0-0 → < 1.19.2 1.19.2
archive/tar 1.18 earliest → < 1.18.7 1.18.7

Other CVEs of archive/tar

The 3 CVEs of archive/tar →
CVE-2026-32288 tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large… 5.5 Medium CVE-2025-58183 tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files 4.3 Medium
Track this CVE