PT-2025-45819 · Go · Stdlib
Published
2025-10-29
·
Updated
2025-10-29
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Stdlib