UNKNOWN Go
Unbounded allocation for old GNU sparse in archive/tar
GO-2026-4869 · BIT-golang-2026-32288 · CVE-2026-32288
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes