CVE-2026-9538

Vendor solution

Upgrade to Archive::Tar 3.10 or later.

Red Hat statement

This Important flaw in perl-Archive-Tar allows a Denial of Service via memory exhaustion when processing specially crafted tar archives. The Archive::Tar module's _read_tar() method reads entry payload sizes from the tar header without enforcing an upper bound, allowing an attacker to craft a tar archive whose header declares a multi-gigabyte entry size, causing immediate large memory allocation. Applications or scripts that process untrusted tar files using Archive::Tar are vulnerable to resource exhaustion.

Red Hat mitigation

To mitigate this issue, avoid processing untrusted tar archives with applications using Perl's Archive::Tar module. If untrusted tar processing is required, consider imposing resource limits (e.g., ulimit) on the processes handling tar files to contain memory exhaustion and prevent wider system impact.