CVE-2026-9538 Details
Description
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
A memory exhaustion vulnerability exists in Archive::Tar versions prior to 3.10 for Perl. The issue arises from the tar header's entry size field, which is controlled by the attacker. The _read_tar() function reads each entry's payload using a method that allows for arbitrary size allocations based on the declared entry size, without any upper limit. This can lead to excessive memory allocation, as demonstrated by a crafted header that claims a multi-gigabyte size, causing Perl to allocate a scalar of that size.
Users are advised to upgrade to Archive::Tar version 3.10 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch | CPANSec | Patch |
| https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/05/26/4 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| archive::tar project archive::tar | < 3.10 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CVE |
| May 26, 2026 | New CVE Received | CPANSec |