PublicCVE

CVE-2026-32288

MEDIUM5.5Denial of service
JSON exportCreate alert

Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

CVSS breakdown

CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Affected products

References

Updated 23m ago · 8 sources