CVE-2026-9538

Name of the Vulnerable Software and Affected Versions Archive::Tar versions prior to 3.10

Description Archive::Tar for Perl allows memory exhaustion when processing a tar header with an attacker-controlled entry size field. The read tar() function reads each entry's payload using $handle->read($$data, $block), where the $block variable is derived from the 12-byte size field in the tar header without an upper bound. A crafted header specifying a multi-gigabyte size forces Perl to allocate a scalar of that size, leading to memory exhaustion.

Recommendations Update to version 3.10 or later.