Memory Exhaustion Risk in modern-tar by ayuhito

CVE-2026-109380

What is CVE-2026-109380?

The modern-tar library versions 0.3.5 to 0.8.5 are susceptible to a memory exhaustion vulnerability, which allows an attacker to create negative entry sizes by using non-octal bytes parsed by the readOctal() function. This attack vector permits the crafting of a specially forged, optionally gzip-compressed archive for the unpackTar() method. During this process, the library can buffer data chunks indefinitely, resulting in excessive memory consumption and leading to a denial of service by suppressing the processing of subsequent archive entries.

References