Buffer Overflow Vulnerability in Go Programming Language's tar.Reader Component

CVE-2026-32288

What is CVE-2026-32288?

The tar.Reader component in the Go programming language is susceptible to a memory allocation vulnerability when processing maliciously-crafted archives. Specifically, if an archive includes a significant number of sparse regions encoded in the 'old GNU sparse map' format, the tar.Reader can allocate an unbounded amount of memory. This could lead to excessive resource consumption, potentially impacting system performance or leading to denial of service scenarios.

References