CVE-2026-9538

A flaw was found in the perl-Archive-Tar component. An attacker can exploit this vulnerability by providing a crafted tar header with an excessively large entry size field. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

This Important flaw in perl-Archive-Tar allows a Denial of Service via memory exhaustion when processing specially crafted tar archives. The Archive::Tar module's _read_tar() method reads entry payload sizes from the tar header without enforcing an upper bound, allowing an attacker to craft a tar archive whose header declares a multi-gigabyte entry size, causing immediate large memory allocation. Applications or scripts that process untrusted tar files using Archive::Tar are vulnerable to resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted tar archives with applications using Perl's Archive::Tar module. If untrusted tar processing is required, consider imposing resource limits (e.g., ulimit) on the processes handling tar files to contain memory exhaustion and prevent wider system impact.