CVE-2026-109380 Details
Description
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
A memory exhaustion vulnerability has been identified in modern-tar versions 0.3.5 through 0.8.5. This vulnerability allows attackers to create negative entry sizes by using non-octal bytes that are improperly parsed by the readOctal() function. By supplying a crafted archive, which can be optionally gzip-compressed, to the unpackTar() function, attackers can cause the application to buffer data indefinitely. This behavior exhausts the process memory, leading to a denial of service by suppressing the extraction of subsequent entries.
Users can upgrade to modern-tar version 0.8.6, which includes a patch for this vulnerability by rejecting malformed octal fields.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| modern-tar | >= 0.3.5, <= 0.8.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |