Executive brief
Archive::Tar is a Perl library used to read and write tar archives. A vulnerability in how it processes files allows an attacker to provide a specially crafted archive that claims to contain a massive file. When the library attempts to read this archive, it will try to allocate a huge amount of system memory based on the attacker's fake file size, potentially causing the application to crash or the entire system to become unresponsive.
Technical details
A memory exhaustion vulnerability exists in Archive::Tar's _read_tar() function. The function reads an entry's payload using a block size derived directly from the 12-byte size field in the tar header without performing upper-bound validation. An attacker can provide a crafted tar header declaring a multi-gigabyte size, forcing Perl to allocate a scalar of that size. This can lead to a Denial of Service (DoS) via memory exhaustion. The issue is resolved in version 3.10 by introducing a $MAX_FILE_SIZE variable (defaulting to 1 GiB) that gates allocations during the read process.
Affected products
- Perl CPAN Archive::Tar < 3.10
Timeline
- 2026-05-25: disclosed: Issue reported to maintainers
- 2026-05-25: patched: Version 3.10 released on CPAN
- 2026-05-26: advisory: Public disclosure via oss-security and NVD