CVE-2022-2879

Unbounded memory consumption when reading headers in archive/tar

published October 14, 2022

CVSS
—
EPSS
2%
Percentile
80.7
In the wild
Unconfirmed
What it is

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02006 · 80.7th percentile
Published
2022-10-14T00:00Z
EPSS history
Timeline
  • 14 OCT 00:00Z
    Unbounded memory consumption when reading headers in archive/tar
    cvelistv5