Fluid Attacks Database

Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	golang-1.25	=1.25.0-1 \|\| =1.25.0-2 \|\| =1.25.1-1 \|\| =1.25.2-1 \|\| =1.25.3-1 \|\| =1.25.6-1 \|\| =1.25.7-1 \|\| =1.25.7-2 \|\| =1.25.8-1 \|\| >=0 <1.25.9-1	1.25.9-1
rpm rhel9	bootc-image-builder-9-7	-	-
rpm rhel9	podman	-	-
rpm rhel9	skopeo	-	-
rpm rhel10	podman	-	-
rpm rhel10	bootc-image-builder-10-0	-	-
rpm rhel8	golang	-	-
rpm rhel9	golang	-	-
rpm rhel10	grafana	-	-
rpm rhel8	grafana	-	-

1-10 of 36

Aliases

1. CVE-2026-322882. NVD-2026-322883. OSV-DEBIAN-2026-322884. OSV-2026-322885. OSV-GO-2026-48696. GCVE-2026-322887. SECURITY-TRACKER-CVE-2026-32288

References

1. https://go.dev/cl/7637662. https://go.dev/issue/783013. https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.