CoreCVE
Back

HIGH

Unbounded memory consumption when reading headers in archive/tar

Published Oct 14, 2022

Description

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

Affected products

Remediation

Red Hat statement

The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang’s Garbage Collector; OpenShift’s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations. This flaw additionally affects the github.com/vbatts/tar-split library and was fixed in v0.12.1.

Metrics

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (12)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Go
Published Oct 14, 2022
Updated Feb 13, 2025
Reserved Aug 17, 2022
Link CVE-2022-2879
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2022-2879
Red Hat
Severity Moderate
Public date Oct 4, 2022
Links CVE-2022-2879 - Bugzilla