CVE-2026-109380

A flaw was found in modern-tar. A remote attacker can trigger a Denial of Service (DoS) by supplying a specially crafted archive containing malformed entry size values. When processing the invalid data, the parser fails to properly calculate file sizes and buffers data indefinitely, leading to memory exhaustion and process termination.

Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can cause an out-of-memory crash of affected applications without requiring elevated privileges. Risk is primarily limited to environments where applications process untrusted archive payloads from external sources. While the flaw enables complete denial of service of the target process, it does not compromise data confidentiality or allow arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.